Help Configuring a 3 Interface PIX

[tpopejr]

I've recently setup a PIX and I know the INSIDE - OUTSIDE translation was working properly but I'm having difficulty configuring the new 'REMOTE' interface on the PIX. I've attached a (very) basic drawing of the network.

In order for the REMOTE LAN to have FULL communication (including PING) with the INSIDE LAN, what commands need to be configured?

I'm assuming the following:

For full two-way communication between INSIDE and REMOTE:

Static (inside,remote) 10.11.1.0 10.11.1.0 netmask - no translation between subnets

Access-list 101 permit ip 10.11.1.0 255.255.255.0 10.10.0.0 255.255.0.0

Access-group 101 in interface remote

I've done this and it still doesn't work. What am I forgetting?

A Million thank you's,

Tom

[mehrdad]

check this out pls :

static (inside,remote) 10.10.0.0 10.10.0.0 netmask 255.255.0.0

[cruz-a]

I think you need a nat 0 statement in addtion to what you have.

PIX(config)#nat (remote) 0 10.11.1.0 255.255.255.0 0 0

[jmia]

Tom,

Have a read of the following document:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008015efa9.shtml

This document gives example of configuring PIX with Mail server access on the DMZ, you can substitute the mail server for your remote LAN.

Hope this help and let me know how you get on, please rate post if it helps.

JM

[tpopejr]

The article did not address my main issue. Full two-way communication between INSIDE and DMZ (or REMOTE in my example).

Additionally, do I have to list the two subnets in between the PIX and the remote network (it's across a T1 - hopping two 1760 routers)?

Thanks,

Tom

[rsmith]

You do not need to list the intermediate subnets, but the PIX does need to know how to get to the 10.11.1.0 network

route REMOTE 10.11.1.0 255.255.255.0 192.168.253.2

Otherwise, it will use the default route.

[jackko]

please post the config

[arumugasamy]

Scenario tested in home network lab:

access-list all permit ip any any

access-list 120 permit ip 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0

nat (inside) 0 access-list 120

static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0

access-group all in interface dmz

We need to configure the NAT 0

I used NAT exemption

I hope It would help ypu

swamy