topic Re: PIX 520 3 PORT VERSION 6.0(1) in Network Security

PIX 520 3 PORT VERSION 6.0(1)

xiao0809 — Fri, 21 Feb 2020 05:48:55 GMT

I have a pix 520 with 3 ports, at the DMZ there is a web server,I use the static command to allow outside user access the web server,To allow inside user access the web server correctly,I use the alias command to resolve the domain name to DMZ IP address 192.168.1.253.

The question is when I use alias command to resolve the domain name , it works well,the domain ip address isn't the global ip address 211.99.175.50.

but the inside user cann't access the webserver.

at this time,I ping the 192.168.1.253, the pix nat it to the outside pool,but if I ping the 192.168.1.252 etc. the pix nat it to the DMZ .

If I don't use the alias command, when i ping the 192.168.1.253, the pix nat it to the DMZ,that is correct,but you know ,the inside user cann't access the webserver correctly at this time.

What can I do,I need your help

Duzaidong , Thanks

Re: PIX 520 3 PORT VERSION 6.0(1)

jekrauss — Sun, 15 Jul 2001 22:39:38 GMT

I'm not sure I completely understand your situation. However, the behavior of the PIX, using the alias command, has changed in 6.0(1). In 6.0(1), when you use the alias command to DNS fixup (which you are trying to do), the PIX interface will now proxy-arp for the aliased address. This is useful if you are using the alias command for destination NAT, but causes DNS fixup to not work.

After you have implemented the alias command, do a show arp and check the MAC address that is associated with your alias address. You may find that it is one of the PIX interfaces (inside or DMZ). If so, then enabling sysopt noproxyarp (PIX_interface) will resolve the issue.

HTH

Jeff

Re: PIX 520 3 PORT VERSION 6.0(1)

xiao0809 — Mon, 16 Jul 2001 04:09:41 GMT

Thanks for your help

According your instruction,I try again but the problem still isn't solved.

when I ping the domain name, The alias command works well, It can transfer the DNS to DMZ address, But the Nat still direct the traffic to the outside interface.