PIX Access list

kuldeep.kaur — Mon, 11 Mar 2019 16:44:12 GMT

Hi Guys,

I have a question about access list on pix. I have a host on inside say 1.1.1.1 which wants to talk to host 2.2.2.2 in DMZ1. I applied the access-list on the inside interface and it is working. How about if host 2.2.2.2 wants to talk to host 1.1.1.1. Do I need an access list from DMZ1 to inside?

Tks

Re: PIX Access list

Jon Marshall — Mon, 30 Nov 2009 21:56:31 GMT

kuldeep.kaur wrote:

Hi Guys,

Tks

For return traffic from 2.2.2.2 to 1.1.1.1 no you don't.

If 2.2.2.2 starts a new connection then yes you do need an acl and you also need to either

1) have a statc NAT statement eg. static (inside,dmz) 1.1.1.1 1.1.1.1 netmask 255.255.255.255

2) have a NAT exemption eg.

access-list NONAT permit ip host 1.1.1.1 host 2.2.2.2

nat (inside) 0 access-list NONAT

3) If the pix is running v7.x or later you can disable NAT altogether on the firewall eg. no nat-control

Jon

topic PIX Access list in Network Security

PIX Access list

Re: PIX Access list