I can't seem to get this going for thie life of me, maybe a little fuzzy on the concepts but I've done this before without problems. I need the DMZ hosts to be able to ping anything we have inside and outside our network. I will lock down anything else after, right now I can't get anything in the DMZ to access anything outside or inside.
interface Ethernet0/0
description Public
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.224
!
interface Ethernet0/1
description Private
nameif inside
security-level 100
ip address 192.168.40.1 255.255.255.0
!
interface Ethernet0/2
description DMZ
nameif dmz
security-level 50
ip address 192.168.41.1 255.255.255.0
access-list dmz-allowed-in extended permit ip any any
access-group dmz-allowed-in in interface dmz
access-list allowed-in extended permit icmp any host 1.1.1.2
access-group allowed-in in interface outside
access-list allow-out extended permit ip 192.168.40.0 255.255.255.0 any
access-group allow-out in interface inside
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 dns
nat (dmz) 1 0.0.0.0 0.0.0.0 dns
static (inside,dmz) 192.168.40.0 192.168.40.0 netmask 255.255.255.0
static (dmz,outside) 1.1.1.2 192.168.41.10 netmask 255.255.255.255
Packet tracer from inside to dmz host 192.168.41.1 says its dropped by implicit rules
Packet tracer from dmz to inside host 192.168.40.1 says its dropped by implicit rules
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Packet tracer from outside to dmz host's public address says its allowed
Packet tracer from dmz to outside address says its allowed
It would see at least ping to the outside from DMZ should work but it doesn't.
