Access from DMZ to inside

[l4nier]

I am trying to allow access from one computer in the dmz to our internal network. This is a temporary setup used for testing. Can anyone point me towards documents on how to do this? I am not mapping to a "legal" address on the Inside. I just want the one computer in the dmz to have UDP access to the computers on the Inside.

Louanne Fournier

lfournier@nexterna.com

[jmia]

Hi Louanne,

The following document might be useful to you:

> http://www.cisco.com/warp/public/707/28.html

Hope this helps -

[msitzman]

The short answer is that the inside host has to have a static translation defined that points to the DMZ interface. It can map to it's own ip address in the statement such as:

static (inside, intf2) 192.168.1.12 192.168.1.12 netmask 255.255.255.255

Then you will have to configure access from the DMZ host to the inside host since it is a lower security zone to a higher security zone. This can be a conduit or an access-list

conduit permit udp host 192.168.1.12 eq host

or:

access-list dmz_int permit udp host host 192.168.1.12

access-group dmz_int in interface intf2

Hope this helps...

Marcus

[l4nier]

Thanks for the quick reply Marcus! I will go ahead and try this but I was wondering why you map the inside machine to itself in the Static statement above. Shouldn't it go to the IP in the dmz? I understand the conduit statement because it maps from one ip to another but I was confused with the static.

Thanks again!

[msitzman]

Hei there,

I mapped the inside IP to itself because there is not usually a need to NAT from the inside to DMZ interfaces. The DMZ interface is usually still part of your private network and therefore any routing should be setup already and then you don't burn an address on the DMZ segment for thhe inside host. You certainly could map the inside host to a global address in the DMZ network if you wanted. Just remember that if you do you will need to change the access-list or conduit to reflect the global address of the inside host.

Marcus

[l4nier]

Ahh I get it! Normally I would use the static to map to a global IP but since it is just dmz to inside I don't need to waste an address.

Thank you again!

Louanne

[l4nier]

One more question, hope you don't mind. In looking over what I have already I see there is a static mapping as follows:

static (inside,dmz) 192.168.20.0 192.168.20.0 netmask 255.255.255.0 0 0

192.168.20. is my inside network. So rather than setting up access for a particular machine a static route has already been setup for the entire inside network. So in this case I only need to add either a conduit or access list statement. Is that correct?

Louanne

[msitzman]

Hi there,

You are correct. That static statment will cover the whole network as being maped to itself to the DMZ interface. All you need now is the conduit or ACL!!

Marcus