PIX statics & ACLs

[brymiller]

Which comes first on an inbound access filter (access-group IN in interface outside): static or ACL?

For example...

Let's say I want to redirect any outside hosts trying to reach 10.7.7.21 in DMZ7 to use 192.1.24.21...

static(DMZ7,outside) 192.1.24.21 10.7.7.21 netmask 255.255.255.255

Now I want to only allow outside users on 205.15.25.0/24 to use HTTP on the redirected host DMZ7's 10.7.7.21.

Since 10.7.7.21 has been translated to 192.1.24.21 do I use...

access-list IN permit tcp 205.15.25.0 0.0.0.255 host 10.7.7.21 eq www

OR

access-list IN permit tcp 205.15.25.0 0.0.0.255 host 192.1.24.21 eq www

TIA

[rsmith · Accepted solution]

Since this access-list is bound to the outside interface, you need the IP address that will correspond to the outside interface. Therefore, your second access-list line should be correct.

access-list IN permit tcp 205.15.25.0 0.0.0.255 host 192.1.24.21 eq www