Access List for DMZ server on Cisco 6509

[blakecrossley]

Hi there

I'm trying to set up my DMZ server (10.0.0.10) to talk to server 172.18.1.114 through port 443.

and I want 10.0.0.10 to be able to get internet access and rdp.

I want to do that using an access list on our cisco 6509 switch. Can someone please help? Thanks :)

So far my config is:

140 permit tcp any host 10.0.0.10 eq 3389 (15 matches)
150 permit udp any host 10.0.0.10 eq 3389 (1 match)
160 permit tcp host 172.18.1.1 eq domain host 10.0.0.10
170 permit udp host 172.18.1.1 eq domain host 10.0.0.10
180 permit tcp host 172.18.1.2 eq domain host 10.0.0.10
190 permit udp host 172.18.1.2 eq domain host 10.0.0.10
200 permit tcp any host 10.0.0.10 eq 443
210 permit tcp any host 10.0.0.10 eq www (57 matches)
250 permit tcp host 172.18.1.114 eq www host 10.0.0.10
260 permit tcp host 172.18.1.114 eq 443 host 10.0.0.10
270 permit tcp host 10.0.0.10 host 172.18.1.114 eq www
280 permit tcp host 10.0.0.10 host 172.18.1.114 eq 443
290 deny ip any host 10.0.0.10 (888 matches)

[Rahul Govindan]

It really depends on where the 6509 is on the topology and in what direction the ACL is applied. Your ACL seems to have inbound rules to your DMZ server, so my assumption is that the ACL is applied on the 6509 in the inbound direction to that server.

You would have to create an outbound ACL to allow access to the other server and internet. If there is no ACL, this should be allowed by default. 

[blakecrossley]

Hi there

 so where would i put the outbound rule to allow communication? Both servers are residing on the 6509. I'm not using the fwsm just an access list.

[blakecrossley]

Hi there

I just need the DMZ server to talk to CWCPWD01 (172.18.1.114).