Allowing Inside Users to FTP on DMZ Interface

mnlatif · ‎11-26-2002

Hi,

I have a FTP Server on the DMZ interface, for which i want to allow Inside Users Access.

With the current configuration, i have ALL inside users being NATed to the Outside Interface for Web Access.

< nat (inside) 1 0.0.0.0 0.0.0.0 0 0>

Is it possible to have Inside Users Access the FTP Server "without" using NAT ?

Should i use <nat 0 ..> command ? If i use this "nat 0.." command, would it effect my existing NAT configuration ?

mnlatif · ‎11-26-2002

Okay. figured it out. No need to define any NAT or Static Statements.

FTP is working Okay, however ICMP was being denied, even though i had

.. statements defined.

ICMP worked , when i applied an Inbound Access-List on DMZ interface.

Why is that ? Is an ACL also needed in addition to statement for allowing ICMP ?

ssdata · ‎11-27-2002

Hi,

ICMP is connectionless protocol, so the is entry in the state-table. This means that PIX does not recognize the reply-packet and it treats it as a new connections. So if you use acls, you have to permit icmp in both interfaces, if you use conduit then one is enough.