Creating a new interface on Pix 516E

[nicktrenary]

I have created and enabled a new interface (DMZ) on a Pix 516E. In the PDM an Implicit Outbound Rule was automatically created for this interface. I could get out to the internet with no problems. I however need to open some ports from the DMZ to the inside interface. When I add a new access rule the outbound rule disappears and I no longer can get to the internet. I tried to recreate a similar rule to allow all tcp traffic to the outside interface from the dmz. The PDM accepted the rule but when I went back to examine it, the rule had been changed from the outside to the inside.

How can I keep the implicit outbound rule and still open ports to the inside?

Thanks,

Nick

[dgloff · Accepted solution]

In general terms:

permit any necessary access to your internal network (web servers, printers, whatever. BE SPECIFIC!!)

deny all access to your internal network (deny ip any subnet)

permit ip any any