PIX Outside and Inside using the same network ID

[adisegna]

How can I give my DMZ interface an ip address on the same network of my external inteface?

I am trying to configure the PIX with an ISA server on the DMZ interface.

Thanks in advance.

[mlowery]

I don't believe you can do that unless you are using the 7.0 code. It says that you can bridge with that firmware, but I don't have a PIX capable of running it, so I can't tell you for sure.

I don't know of anyway to do it with 6.3(4).

[johansens]

What you want to do is do NAT.

See this setup:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v52/config/examples.htm#xtocid5

[adisegna]

Yeah that's why I do currently. I'm just having issues with the ISA 2004 denying traffic. I can't put my finger on the problem yet.

I'm routing the traffic through to the DMZ interface

Static + ACL is defined to allow everything in from outside to DMZ. Should I set the static to be:

static (DMZ,outside) pub.ip.add int.ip.add 0 0 norandomseq

or

static (DMZ,ouside) pub.ip.add pub.ip.add 0 0 norandomseq

access-list permit_in permit any host pub.ip.add

access-group permit_in in interface outside

Is anyone using a ISA 2004 server behind a PIX and publishing internal servers?

[johansens]

You could try something like this:

static (DMZ,outside) pub.ip.add dmz.ip.add netmask 255.255.255.255

nat (DMZ) 2 dmz.ip.add 255.255.255.255

global (outside) 2 pub.ip.add

access-list outside-in permit ip any host pub.ip.add

access-list dmz-in deny ip host dmz.ip.add internal.ip.networks internal.ip.netmasks

access-list dmz-in permit ip host dmz.ip.add any

access-group outside-in in interface outside

access-group dmz-in in interface dmz

The ISA-server should then have the IP-address dmz.ip.add on it's interface in the DMZ. This is of course not the public IP-address... :)