File Server in DMZ - I can ping it, but can't connect via unc path

[Ian Walker]

host = Windows Server 2003 in DMZ ( 192.168.171.21 )

I can ping it from my INSIDE network ( INSIDE = 192.168.172.0 )

But I can't connect via UNC path

access-list dmz_access_in extended permit ip 192.168.171.21 255.255.255.0 192.168.172.0 255.255.255.0

access-list dmz_access_in extended permit udp host 192.168.171.21 192.168.172.0 255.255.255.0 eq netbios-ns

access-list dmz_access_in extended permit udp host 192.168.171.21 192.168.172.0 255.255.255.0 eq netbios-dgm

access-list dmz_access_in extended permit tcp host 192.168.171.21 192.168.172.0 255.255.255.0 eq 139

access-list dmz_access_in extended permit tcp host 192.168.171.21 192.168.172.0 255.255.255.0 eq 445

Is this even a firewall issue or a M$ issue?

Thanks,

Ian.

[andyjames]

Hello,

Looks as though you have the right ports in the acl for the DMZ, is the acl on the Inside interface permitting everything through?

Have you filtered the logs by IP address and tried to connect? Would show if anything is being blocked along the way.

[Ian Walker]

My understanding is that a stateful connection originating from the INSIDE Security level 100 will be allowed back in from DMZ security level 50 ?

On the inside interface I have only the default 1 implicit incoming rule

Source = ANY       Destination = Anly less secure

Do I need acl on INSIDE interface ?

Thanks,

Ian.

[andyjames]

Hi,

Yep, if you only have the default rule on the Inside then it should allow the flow through to the DMZ and back. No need for an acl on the Inside, just wasn't sure if you had one other than the default or not.

Would try filtering the logs to see if anything is being blocked, other than that, packet tracer might flag something up.