PIX DMZ Traffic unavailable from inside

[dgaunt]

I have a PIX515E running 6 interfaces, I have a DMZ interface with a Server running IPSwitches WS_FTP Server on it. I have a Static NAT from the outside to a Public IP address. The FTP Server is truely set up on a private IP address on the DMZ interface. The problem comes when the FTP Server transfers into PASV mode, it sends its (public)IP address to start a new session. All sessions from the inside cannot get to the FTP server at this point, because of the Public IP. Any ideas on how to fix this would be greatly appreciated.

[Patrick Iseli]

Two choices:

Disabled NAT between the inside and the dmz interface and connect with the private IP.

static (inside,dmz) InsideNet InsideNet netmask InsideSubnetMask 0 0

OR:

Translate the public ip to a private IP of your FTP Server (Destination NAT).

static (dmz,inside) Public-FTP-IP Private-FTP-IP

sincerely

Patrick