topic Re: Attempt at easy DMZ in Network Security

Attempt at easy DMZ

adcorbett_2 — Mon, 11 Mar 2019 14:27:42 GMT

Hello - I am trying to set up (for the first time) a simple DMZ on my PIX 515. Here is the DMZ layout. I have a PIX 515 connected to a 2950 switch that has one server (for now) that I need to have the world access a webpage on. I though I had it set up right, but I can't see it from the outside world, or from my private network behind the PIX. I can see the server from within the PIX. I am attaching my config, and any help would be great. I know I am probably missing a few things. Thanks!

Re: Attempt at easy DMZ

ajagadee — Thu, 18 Dec 2008 20:58:18 GMT

Andy,

I am assuming that the web server that you are talking about is with the ip address 172.16.99.10. If so, the static looks good.

static (DMZ,outside) 72.93.X.6 172.16.99.10 netmask 255.255.255.255

But, I dont see any access-list applied on the outside interface. You need to define an access-list to permit web traffic to this server.

Example:

access-list 100 permit tcp any host 72.93.X.6 eq 80

access-group 100 in interface outside

Regards,

Arul

*Pls rate all helpful posts*

Re: Attempt at easy DMZ

adcorbett_2 — Tue, 23 Dec 2008 19:38:24 GMT

ok great!! Its working perfectly from outside now. Thank you.

Next - I need to have one server on my production network (192.168.2.8) talk to the server on the DMZ (172.16.99.10). How can I do that?

Re: Attempt at easy DMZ

ajagadee — Tue, 23 Dec 2008 19:58:57 GMT

Hi,

Glad to be of help. Could you update the forum that the solution resolved the issue, so others who run into similar issue can benefit out of the post. Thanks!

If the prod network is on the inside interface:

static (inside,dmz) 192.168.2.8 192.168.2.8

By default, there are not ACLs applied on the inside interface. In case if you have configured one, make sure that you permit the necessary ports/protocols for this server.

Regards,

Arul

*Pls rate all helpful posts*

Re: Attempt at easy DMZ

adcorbett_2 — Tue, 23 Dec 2008 20:00:27 GMT

Thanks for your help!