I have a PIX with four interfaces
Outside – Security 0
Extranet – Security 15 - 10.3.0.0/16
DMZ – Security 50 - 10.2.0.0/16
Inside – Security 100
I am having problems getting traffic between the Extranet and DMZ interfaces. Traffic between the other interfaces works fine.
When trying to ping or WWW between Extranet and DMZ interfaces I see the following error message “No route to 10.3.1.3 from 10.2.0.13”. Since these networks are directly connected and I can ping these address from the PIX. Also since I can access each of these interfaces from the Inside interface, I doubt it really is a routing error.
I think it’s a translation issue, but can’t figure out what. I’d like to have the address from extranet and DMZ to be translated to themselves (i.e. traffic from 10.2.0.1 on the DMZ should be from 10.2.0.1 on the extranet).
Please check out my config and let me know if you have any idea. Config has been pruned of non-related info.
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
nameif ethernet3 extranet security15
nameif ethernet4 eth4 security20
nameif ethernet5 failover security25
hostname bri52-zfw01
access-list from-dmz permit tcp any any object-group Webservices
access-list from-dmz permit tcp object-group PS-Webservers any object-group PS_JOLT_PROD
access-list from-dmz permit tcp host 10.2.0.24 host 10.1.2.74 object-group CumulusPorts
access-list from-dmz permit tcp any host 10.1.2.23 object-group VBulletin
access-list from-dmz permit udp any host 10.1.2.23 eq pcanywhere-status
access-list from-dmz permit tcp any object-group Mail-servers_ref_2 object-group Mail-services
access-list from-dmz permit udp any object-group Mail-servers_ref_2 eq 113
access-list from-dmz permit tcp any object-group Remote-access-internal_ref_1 object-group External-services
access-list from-dmz permit udp any object-group Remote-access-internal_ref_1 object-group External-services-udp
access-list from-dmz permit tcp object-group Webservers object-group MerlinAppServers_ref object-group Merlin-app-ports
access-list from-dmz permit udp object-group Webservers object-group MerlinAppServers_ref object-group Merlin-app-shared-folder
access-list from-dmz permit icmp any any
access-list from-dmz permit tcp any any object-group Domain-trust-TCP
access-list from-dmz permit udp any any object-group Domain-trust-UDP
access-list from-dmz permit udp any any
access-list from-dmz permit tcp any host 65.122.194.108 eq smtp
access-list VPN-IRL remark Prevent any VoIP traffic to be routed over the VPN to IRL
access-list VPN-IRL deny ip 10.10.0.0 255.255.0.0 172.18.0.0 255.255.0.0
access-list VPN-IRL remark Allow VPN connection to IRL
access-list VPN-IRL permit ip 10.0.0.0 255.192.0.0 172.18.0.0 255.255.0.0
access-list VPN-IRL remark Allow VPN connection to IRL from RA VPN Pool
access-list VPN-IRL permit ip 172.16.1.0 255.255.255.0 172.18.0.0 255.255.0.0
access-list VPN-HIL remark Allow VPN connection to HIL
access-list VPN-HIL permit ip 10.0.0.0 255.192.0.0 172.20.0.0 255.255.0.0
access-list VPN-HIL remark Allow VPN connection to HIL from RA VPN Pool
access-list VPN-HIL permit ip 172.16.1.0 255.255.255.0 172.20.0.0 255.255.0.0
access-list NO-NAT remark Don.t NAT traffic sent to IRL
access-list NO-NAT permit ip 10.0.0.0 255.192.0.0 172.18.0.0 255.255.0.0
access-list NO-NAT remark Don.t NAT traffic sent to HIL
access-list NO-NAT permit ip 10.0.0.0 255.192.0.0 172.20.0.0 255.255.0.0
access-list NO-NAT-DMZ remark Don't NAT traffic sent to IRL
access-list NO-NAT-DMZ permit ip 10.2.0.0 255.255.0.0 172.18.0.0 255.255.0.0
access-list NO-NAT-DMZ remark Don't NAT traffic sent to HIL
access-list NO-NAT-DMZ permit ip 10.2.0.0 255.255.0.0 172.20.0.0 255.255.0.0
access-list NO-NAT-DMZ permit ip 10.2.0.0 255.255.0.0 10.3.0.0 255.255.0.0
Remainder of config next post
