second Webserver on DMZ not visible outside

[slunney]

Using a PIX 515e

I have multiple webservers in the DMZ the first web server and the mail server are set up with the port mapping to the PIX outside interface IP address.

The second and third(on the inside interface) webservers are set up with static mappings and access lists.

I can see the first webserver nad the mail server fine but I can't see the second or third servers.

what have I done wrong?

[slunney]

Here are the relevent sections of the configuration.

global (outside) 1 interface

global (outside) 2 207.236.60.39

global (inside) 1 interface

global (DMZ) 1 interface

global (DMZ) 2 192.168.10.39

nat (inside) 2 National 255.255.255.0 0 0

nat (inside) 2 Regions 255.255.255.0 0 0

nat (DMZ) 1 192.168.10.9 255.255.255.255 0 0

static (DMZ,outside) tcp 207.236.60.35 www 192.168.10.11 www netmask 255.255.255.255 0 0

static (DMZ,outside) tcp interface www 192.168.10.3 www netmask 255.255.255.255 0 0

static (DMZ,outside) tcp interface smtp 192.168.10.9 smtp netmask 255.255.255.255 0 0

static (DMZ,outside) tcp interface pop3 192.168.10.3 pop3 netmask 255.255.255.255 0 0

static (DMZ,outside) udp interface domain 192.168.10.3 domain netmask 255.255.255.255 0 0

static (DMZ,outside) tcp interface 8080 192.168.10.3 8080 netmask 255.255.255.255 0 0

static (DMZ,inside) tcp 192.168.10.3 smtp 192.168.10.9 smtp netmask 255.255.255.255 0 0

static (inside,DMZ) Danny Danny netmask 255.255.255.255 0 0

static (inside,DMZ) Arnold Arnold netmask 255.255.255.255 0 0

static (inside,DMZ) 207.236.60.40 192.168.2.86 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group Service_access_in in interface DMZ

access-list outside_access_in permit icmp any any traceroute

access-list outside_access_in permit tcp any interface outside object-group outsideservices

access-list outside_access_in permit tcp any host 207.236.60.35 object-group outsideservices

[Patrick Iseli]

The config looks good, have you done a "clear xlate" after you applied the new rules?

Note: clear xlate will reset all connection!

You were talking about this rules?

static (DMZ,outside) tcp 207.236.60.35 www 192.168.10.11 www netmask 255.255.255.255 0 0

access-list outside_access_in permit tcp any host 207.236.60.35 object-group outsideservices

Which one does not work ?

sincerely

Patrick

[slunney]

I did a clear xlate, I also did a cold boot a couple of times.

I can attach to the servers port mapped to 207.236.60.34

but not 207.236.60.35 or 207.236.60.35

[Patrick Iseli · Accepted solution]

I suggest you to analysze the trafic with the PIX "capture" command and sniff the traffic on the dmz and outside traffic.

Check if packets got to the outside interface, does it reach the web server and is there a response.

example

access-list 120 permit ip any HOST 207.236.60.35

capture vpncap access-list 120 interface OUTSIDE

show capture vpncap access-list 120 detail

or

https://pix-ip-address/capture/vpncap[/pcap]

To remove capture:

no capture vpncap

sincerly

Patrick