I have form a dmz in pix, for example, assigning 157.1.1.0/24 for outside, assigning 157.128.1.0/24 for dmz, and assign 10.10.10.0/24 for inside.An inside node act as mail server for internet.The command is:
(conf)#static (inside,outside) 157.1.1.9 10.10.10.9...
(conf)#access-list acl_out per tcp any 157.1.1.9 eq smtp
(conf)#access-group acl_out in interface outside
And at the same time, I place the dns & another e-mail server in dmz. The dns server can resolv the whole network node's names. for the node in dmz , dns give the outside real ip. So mail serve in dmz can't visit the inside mail server with outside real address.I add follow commands to resolv this problem:
(conf)#static (inside,dmz) 157.1.1.9 10.10.10.9
(conf)#access-list acl_dmz permit tcp any host 157.1.1.9 eq smtp
(conf)#access-group acl_dmz in interface dmz
(conf)#route dmz 157.1.1.9 255.255.255.255 157.128.1.1(dmz interface ip address)
server in dmz can reach the inside mail server via smtp,but it can't reach outside.can give me some advises?
thanks.
