RE: [fw-wiz] PIX DMZ inter-access via outside IP address

From: Keith Anderson (keith_at_purescience.com)
Date: 12/08/03

  • Next message: Brett Charbeneau: "[fw-wiz] Stateful inspect on return web traffic - eek!" 
    To: <justiceguy@pobox.com>
Date: Mon, 8 Dec 2003 09:39:34 -0700

    Nope, aliases are already implemented and that allowed devices on each
    interface to access the OTHER interfaces using the Internet IP address, but
    not from the DMZ back to the DMZ using the Internet address.

    The problem ended up being a routing issue. Packets destined to the outside
    interface would get ignored by the router because they were assumed to be
    destined for a device on that domain. The solution was to use non-Internet
    routable addresses between the PIX and the router. Now that it has a
    different IP class, the router redirects those packets back to the PIX, and
    communication using the Internet addresses works on all interfaces.

    Thanks for your help, however.

    > -----Original Message-----
    > From: Jason Ostrom [mailto:justiceguy@pobox.com]
    > Sent: Monday, December 08, 2003 9:35 AM
    > To: Keith Anderson
    > Cc: firewall-wizards@honor.icsalabs.com
    > Subject: Re: [fw-wiz] PIX DMZ inter-access via outside IP address
    >
    >
    > Keith,
    >
    > Based on what you have described, it sounds like you need to use the
    > "alias" command. My understanding is you are trying to have the DMZ
    > hosts sourced on the RFC1918 network reach each other based on public
    > destination addresses. The alias command will solve this problem.
    >
    > From the PIX 6.3 OS command reference:
    > [no] alias [(if_name)] dnat_ip foreign_ip [netmask]
    >
    > Usage Guidelines
    >
    > The alias command translates one address into another. Use
    > this command to prevent conflicts when
    > you have IP addresses on a network that are the same as those
    > on the Internet or another intranet.
    > You can also use this command to do address translation on a
    > destination address. For example, if a
    > host sends a packet to 209.165.201.1, you can use the alias
    > command to redirect traffic to another address,
    > such as, 209.165.201.30.

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Brett Charbeneau: "[fw-wiz] Stateful inspect on return web traffic - eek!"

    Relevant Pages

    • Re: pix nat
      ... Yes I have add but telnet command does not work because the internet ip ... is not in the same subnet as your inside interface 10.112.2.241. ... to the outside interface by using the access-group command. ...
      (comp.dcom.sys.cisco)
    • Block internal IP with Cisco PIX 501
      ... outside interface ie internet on a PIX 501. ... I was hoping for a little help with the command line. ...
      (comp.dcom.sys.cisco)
    • Re: Problem configuring NAT to share Internet Connection
      ... One of my NICs in the server connect to a DSL ... modem and it connects to internet. ... > interface, that connects to the DSL modem, LAN interface, that connects to ... >> 7.- To connect server to Internet, I create a new network connection. ...
      (microsoft.public.win2000.ras_routing)
    • Internet thru Cisco 871
      ... SDM wizards and didn't get the internet. ... expected static IP address on the Dialer0 interface but fail ping ... zone security private ... ip http access-class 3 ...
      (comp.dcom.sys.cisco)
    • Re: Problem configuring NAT to share Internet Connection
      ... This is the IPCONFIG information of the server (where you can see Internet ... interface, that connects to the DSL modem, LAN interface, that connects to ... > 7.- To connect server to Internet, I create a new network connection. ...
      (microsoft.public.win2000.ras_routing)