RE: [fw-wiz] help...

From: Claussen, Ken (Ken@kccweb.com)
Date: 02/19/03

  • Next message: Loomis, Rip: "[fw-wiz] DNS UDP packets > 512 bytes (was: (no subject))" 
    From: "Claussen, Ken" <Ken@kccweb.com>
To: "michael" <madams@humanfactors.com>, <firewall-wizards@honor.icsalabs.com>
Date: Wed, 19 Feb 2003 07:21:14 -0500

    You want to employ a technique called "Identity NAT" (Search Cisco for
    more info). It looks like in versions prior to 5.3 you must configure it
    as Nat 0.
    nat [(if_name)] 0 local_ip [netmask [max_conns [em_limit]]]
    [norandomseq]
    If your DMZ network was 192.168.225.0 255.255.255.0 then the command
    could look like(With unrestricted Max Connections and no Embryonic
    Limit),
    NAT DMZ 0 192.168.225.0 255.255.255.0 0 0
    http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_r
    eference_chapter09186a00800ec9e9.html#xtocid4
    (Watch Word Wrap). The docs I read said this should be backwords
    compatible, but you might want to check the NAT command syntax for your
    version specifically. This statement allows the Hosts in the DMZ to talk
    to the inside with their given IP address.

    Ken Claussen MCSE(NT42K) CCNA CCA
    "In Theory it should work as you describe, but the difference between
    theory and reality is the truth! For this we all strive"

    -----Original Message-----
    From: michael [mailto:madams@humanfactors.com]
    Sent: Monday, February 17, 2003 2:04 PM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [fw-wiz] help...

    I have a problem which is actually supposed to be easy--at least
    according to the Cisco examples, but seems to be giving me fits. I just
    can't figure out where I'm going wrong. A particular company--being
    rather, shall we say, posessed of parsimonious pecuniary policies, will
    not update one of their old PIX firewalls beyond version 4.2. In
    itself, that's not really too much of an issue. It has three interfaces,
    and one of them is now to be designated as a DMZ. (This
    version--although old--of the IOS does indeed handle more than two
    interfaces)

    I have set it up according to examples on CCO, and interestingly enough
    it will work just fine when passing traffic from the outside interface
    to the DMZ interface. The DMZ is configured for NAT. However, the one
    thing that has me stumped is why I cannot get it to--through either
    statics or conduits--communicate with an interface which is of "higher"
    security level. According to everything I know (which admittedly is not
    omnicient) this can be done even though by default a "lower" security
    level interface does not communicate with a "higher" level unless
    exceptions are made. There are examples on CCO. But it doesn't so far
    work. I can ping a host on the DMZ, but the host is not actually
    responding--the PIX does because of a static mapping...

    Any advice that would be helpful in creating an exception that would
    allow traffic initiated from the inside interface to the DMZ interface
    to actually work?

    Thanks!

    Michael

    _______________________________________________
    firewall-wizards mailing list firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    Relevant Pages

    • Re: PIX & Global Address Pools
      ... thru to a Proxy server in the DMZ for Internet access. ... NAT on the inside interfaces ... so you have both NAT/ PAT configured, once the NAT address are used it ... If you have inside users talking to a proxy on the DMZ and lack of addresses, PAT the IP's to a single IP address = the DMZ interface when traffic flows through the inside of the firewall onto the DMZ. ...
      (comp.dcom.sys.cisco)
    • Re: Is there a simpler way of stopping NAT for specific interfaces on an ASA5505?
      ... Currently I have a DMZ interface, and a LAN interface which is on ... I have the following command in the firewall to allow traffic to flow ... observe the no NAT with those as well for traffic on the DMZ. ...
      (comp.dcom.sys.cisco)
    • Re: Multiple NATs PIX 515
      ... the inside interface has no need to reach the outside. ... The dmz is trying to reach an address of 10.250.30.30. ... I currently have a static NAT which allows an outside address direct ... > If you want the inside and DMZ hosts to retain their original addresses ...
      (comp.dcom.sys.cisco)
    • VPN with NAT on PIX
      ... I must create a site-to-site VPN with a customer X that has in its ... internal network the same ip range of my *inside* interface. ... X provides me the subnet it's going to use to NAT its PCs when they ... The overlapping is for inside and DMZ ...
      (comp.dcom.sys.cisco)
    • [fw-wiz] Double firewall setup (long)
      ... One PIX 515E w/ 3 interfaces: inside, outside, DMZ. ... access-list OUTB permit tcp 10.181.8.0 255.255.248.0 any eq www ... interface ethernet0 auto ...
      (Firewall-Wizards)