PIX 515E DMZ -> inside issue

[jstary]

I have a web server inside a DMZ and an FTP server on the inside interface...and I can't get the web server to connect to the FTP server. My config is:

ip address outside 62.3.2.162 255.255.255.224

ip address inside 192.168.3.1 255.255.255.0

ip address dmz 192.168.2.1 255.255.255.0

global (outside) 1 62.3.2.171-62.3.2.189 netmask 255.255.255.224

global (outside) 1 62.3.2.190 netmask 255.255.255.224

global (dmz) 1 192.168.2.10-192.168.2.11 netmask 255.255.255.0

global (dmz) 1 192.168.2.254 netmask 255.255.255.0

nat (inside) 1 192.168.3.0 255.255.255.0 0 0

static (inside,dmz) 192.168.2.10 192.168.3.4 netmask 255.255.255.255 0 0

conduit permit tcp host 192.168.3.4 eq ftp any

The web server is on the DMZ at address 192.168.2.10 and the FTP server is on the inside interface at 192.168.3.4. I figured if I had setup the static between them, and then a conduit to allow traffic on the ftp port, everything should be fine. Well, it just doesn't work. Any assistance would be greatly appreciated (aside from "use ACLs instead").

[edadios]

Your global (dmz) 1 pool overlaps the static (inside,dmz).

Actually, the pix global pool is in conflict with the address of the server itself 192.168.2.10.

The pix would think it owns that ip address. So remove the .10 from the pool.

Regards,

[jstary]

Actually that line was removed already. It was just something I had tried. Sorry for the confusion. And someone also told me that I don't need a static to go from the DMZ IP to the inside IP, so I removed my attempts to use static and instead focused solely on using a conduit. I tried both of the following:

conduit permit tcp host 192.168.3.4 eq ftp host 192.168.2.10

conduit permit tcp host 192.168.3.4 host 192.168.2.10

To try and open an FTP path with no luck. I posted my full config here:

http://hx009.dyndns.org/config.txt

Any other assistance you can provide would be greatly appreciated.

[edadios]

Do this on config mode.

static (inside,dmz) 192.168.2.10 192.168.3.4

conduit permit tcp host 192.168.3.4 eq ftp host 192.168.2.10

conduit permit tcp host 192.168.3.4 host 192.168.2.10

clear xlate

Then try again.

Regards,

[m.mcconnell]

Actually the static should read like this:

static (inside, dmz) 192.168.3.4 192.168.3.4

This turns off NAT for the inside FTP server.

Then the fftp conduit would point to the 192.168.3.4 IP address.