Hi all,
I've got a pix 515 with a dmz interface. I'm trying to do a relatively simple thing but my lack of experience with configuring a pix from scratch is showing. Please forgive the newbie nature of the question :).
What i'm trying to do:
Outside (public) : x.x.x.233 - x.x.x.238/255.255.255.248
DMZ : 192.168.1.1 - 192.168.1.254/24
Inside : 10.1.1.1 - 10.1.1.254/24
On the DMZ I want to host 3 web servers and a video server. 2 of the web servers need to speak with a db server on the inside via 1433 The other web server is an OWA front end server(windows 2k) and needs to speak with a domain controller and mail server on the inside over a variety of ports.
The video server has no need to communicate to the inside.
I've created a set of rules and the result is that none of the web servers are accessible from the outside - in fact as far as I can tell, there is no communication from the DMZ to the outside whatsoever. I can't browse from the DMZ, I can't hit a DMZ server, I can't ping from the DMZ... - nothing.
The database server is accessible from the DMZ to the inside as well as DNS servers from the DMZ to the inside and I haven't tested owa. The problem is that I don't have much of a window of opportunity for installing/testing this - on the order of 2 hrs. I tried to install last night and basically my 2 hrs were up with no (very limited) success.
Following is the configuration (sanitized for public consumption) – anything jump out at anyone????
Thanks in advance for any help/suggestions!
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security10
hostname fw1
domain-name domain.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
ip address outside x.x.x.237 255.255.255.248
ip address inside 10.1.1.1 255.255.255.0
ip address dmz1 192.168.1.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.1.1.100 255.255.255.255 inside
pdm location 10.1.1.116 255.255.255.255 inside
pdm location 10.1.1.117 255.255.255.255 inside
pdm location 192.168.1.100 255.255.255.255 dmz1
pdm location 192.168.1.101 255.255.255.255 dmz1
pdm location 192.168.1.102 255.255.255.255 dmz1
pdm location 192.168.1.103 255.255.255.255 dmz1
pdm location 192.168.1.0 255.255.255.0 dmz1
pdm history enable
arp timeout 14400
global (outside) 1 x.x.x.238
nat (inside) 1 10.1.1.0 255.255.255.0 0 0
nat (dmz1) 1 192.168.1.0 255.255.255.0 0 0
static (inside,outside) tcp x.x.x.234 5151 10.1.1.100 5151 netmask
255.255.255.255 0 0
static (dmz1,outside) x.x.x.236 192.168.1.102 netmask 255.255.255.255 0 0
static (dmz1,outside) x.x.x.235 192.168.1.100 netmask 255.255.255.255 0 0
static (dmz1,outside) x.x.x.234 192.168.1.103 netmask 255.255.255.255 0 0
static (inside,dmz1) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0
static (inside,outside) x.x.x.237 10.1.1.114 netmask 255.255.255.255 0 0
conduit permit tcp host x.x.x.237 eq www any
conduit permit tcp host x.x.x.237 eq ftp any
conduit permit tcp host x.x.x.237 eq 5150 any
conduit permit tcp host x.x.x.237 eq 443 any
conduit permit tcp host x.x.x.236 eq www any
conduit permit tcp host x.x.x.235 eq www any
conduit permit tcp host x.x.x.234 eq 4550 any
conduit permit tcp host x.x.x.234 eq 5550 any
conduit permit udp host x.x.x.234 eq 5550 any
conduit permit udp host x.x.x.234 eq 4550 any
conduit permit tcp host x.x.x.234 eq 8080 any
conduit permit tcp host x.x.x.234 eq www any
conduit permit tcp host 10.1.1.116 eq 1433 host 192.168.1.101
conduit permit tcp host 10.1.1.116 eq 1433 host 192.168.1.102
conduit permit tcp host 10.1.1.116 eq 389 host 192.168.1.100
conduit permit tcp host 10.1.1.116 eq 3268 host 192.168.1.100
conduit permit tcp host 10.1.1.116 eq 88 host 192.168.1.100
conduit permit tcp host 10.1.1.116 eq domain host 192.168.1.100
conduit permit tcp host 10.1.1.116 eq 135 host 192.168.1.100
conduit permit udp host 10.1.1.116 eq domain host 192.168.1.100
conduit permit udp host 10.1.1.116 eq 88 host 192.168.1.100
conduit permit udp host 10.1.1.116 eq 389 host 192.168.1.100
conduit permit tcp host 10.1.1.117 eq www host 192.168.1.100
conduit permit tcp host 10.1.1.117 eq 143 host 192.168.1.100
conduit permit tcp host 10.1.1.117 eq pop3 host 192.168.1.100
conduit permit tcp host 10.1.1.117 eq smtp host 192.168.1.100
conduit permit tcp host 10.1.1.117 eq 691 host 192.168.1.100
conduit permit tcp host 10.1.1.116 eq domain host 192.168.1.101
conduit permit udp host 10.1.1.116 eq domain host 192.168.1.101
conduit permit icmp any any echo-reply
conduit permit icmp any any unreachable
conduit permit icmp any any time-exceeded
conduit permit udp host 10.1.1.116 eq domain 192.168.1.0 255.255.255.0
conduit permit tcp host 10.1.1.116 eq domain 192.168.1.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 x.x.x.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 10.1.1.117 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80
