Accessing a DMZ from the inside.

[rcarroll]

A PIX will only let a user acces a resource in a DMZ by it's private IP address and not it's public address. I'm sure there is a reason for that that is security-based, but I don't know what it is. Can any one point me to documentation or explain that to me? Thanks.

[nkhawaja]

Hi,

This is not a security reason, rather a routing reason. If a packet comes into PIX, it will route the packet directly to the DMZ interface. Doing this, the PIX doesnot require any Translation, just simple routing. But if you want to use public address for the DMZ, then you need to use Destination NAT feature.

Thanks

Nadeem