RE: [fw-wiz] PIX 520 - control traffic between DMZ and inside devices

From: Brian A Kee (
Date: 12/17/02

From: "Brian A Kee" <>
To: "Eye Am" <>, <>
Date: Tue Dec 17 10:24:17 2002


I thought about this a little more last night.
The Nat 0 rule should be used for the internal server.

nat (inside) 0 <Internal-ServerIP> <Mask>


-----Original Message-----
[]On Behalf Of Brian A
Sent: Monday, December 16, 2002 6:53 AM
To: Eye Am;
Subject: RE: [fw-wiz] PIX 520 - control traffic between DMZ and inside

Remember that with the PIX you must take account for the security level of
the interface. If you are going from a lower security level to a higher
level, you will need a NAT rule and an ACL (conduit). In this case you could
probably use NAT 0(zero). This will allow trafic to traverse the PIX from
the DMZ to the Inside. Keep in mind you will still need ACLs (conduits) to
allow the specified traffic.

Assuming you have the Server Statically mapped to an external Address:
static (dmz,outside) <LocalIP> <GlobalIP> netmask <Mask>

you should be able to configure a nat 0 (zero) rule like:
nat (dmz) 0 <LocalIP> <Mask>

The staqtic shouls translate all requests from the outside world, while the
Nat 0 (zero) rule should grab all request originating from within the
Internal Network.

There should be several other ways to do this.


-----Original Message-----
[]On Behalf Of Eye Am
Sent: Monday, December 16, 2002 12:14 PM
Subject: [fw-wiz] PIX 520 - control traffic between DMZ and inside

Being confused right now, I'll try to word this as un-confusing as possible.

Scenario as follows

The pic at is the basic
network configuration I need and will be needed to make any sense out of the

PIX 520, Three interfaces - inside, Outside and DMZ.

Webserver (Win2kServer) in DMZ.

6509 Switch with MSM (routing)

Traffic successfully limited to ports 80 and 443 between Outside and DMZ in
the PIX using NAT/Access-list/Group

Default gateway for the all DMZ devices is the PIX int E2 "DMZ"

Default gateway for all inside devices is "6509MSM"

I can successfully ping any DMZ device from the 6509 MSM si it knows how to
get to DMZ and back.

I cannot ping any inside devices from the PIX "DMZ" interface

I cannot ping any DMZ devices from any devices on the inside

Hers's my quandry: The webserver also needs to be limited to port 1433, TCP
and UDP, to a specific MSSQL server on the inside and all traffic may flow
on all ports to another computer on the inside. How do I control traffic
between DMZ and inside devices?

Is this do-able within the PIX or do I need to use MSM (or combination) to
complete this piece?

I've been tearing my hair out trying to get this to happen in the PIX to no
Seems no matter what combination of access-lists/groups I install there is
no limit to traffic flowing between DMZ and inside.

Chuck Genrich

firewall-wizards mailing list

firewall-wizards mailing list

Relevant Pages

  • PIX ,and Domain Controller errors to the DMZ
    ... I have a PIX 515e running 7.02, and for the most part, it works great. ... We're putting a file server into the DMZ so that outside users will ... a domain controller on the INSIDE of the PIX. ...
  • Re: problem with connection from inside to DMZ via global IP
    ... i have pix 525 and configured www server on DMZ ... Try using a DNS statement on ...
  • Re: [fw-wiz] PIX 6.1 xlate issues
    ... I recently saw a PIX 515E become so overwhelmed with the number of NAT ... show xlate count, a log entry and the show mem output. ... have a proxy server, SMTP server, DNS server and about 1500 users ...
  • RE: Configuration for SMTP in DMZ-PIX
    ... check the PIX access rule and the network relationship from internal to DMZ. ... I am able to test the SMTP server from the internet thru the PIX and also ...
  • RE: [fw-wiz] PIX 520 - control traffic between DMZ and inside devices
    ... problems similar to what you discussed with NAT on the PIX. ... We did use NAT, static xlate from DMZ to inside, and access-lists to limit ... Also since our DMZ machines have a default gateway of the PIX and our inside ... between the two interfaces without configuration on the MSM. ...