RE: [fw-wiz] pix nat question

From: Melson, Paul (PMelson_at_sequoianet.com)
Date: 01/23/04

  • Next message: Ludolph, Michel: "[fw-wiz] Broken pipe on SSL connections" 
    To: "Strydom, Willie" <WStrydom@fnb.co.za>, <firewall-wizards@honor.icsalabs.com>
Date: Fri, 23 Jan 2004 10:36:12 -0500

    Absolutely. You just have to think like a PIX. :-)

    Say your internal network is 10.0.0.0/16 and your DMZ host and network are 192.168.0.3/16, and your outside is 1.2.3.0/24, with the DMZ host statically NAT-ed to 1.2.3.4, your config looks like this now:

    static (dmz, outside) 1.2.3.4 192.168.0.3 netmask 255.255.255.255 0 0

    If you want it to appear this way on the inside network, you need to create a global for the DMZ network, and then a static, like so:

    global (dmz) 1 interface
    static (dmz, inside) 1.2.3.4 192.168.0.3 netmask 255.255.255.255 0 0

    PaulM

    > -----Original Message-----
    > On a Checkpoint one can call a host in a DMZ on the physical
    > address and on
    > the "NAT" address from the internal network. Due to the way
    > the statics work
    > on a pix this is not possible, or is it. I see you can do
    > statics with acl's
    > in newer IOS's, I wonder if anyone has ever managed to get the same
    > functionallity as the above checkpoint example.
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Ludolph, Michel: "[fw-wiz] Broken pipe on SSL connections"

    Relevant Pages

    • RE: Configuration for SMTP in DMZ-PIX
      ... check the PIX access rule and the network relationship from internal to DMZ. ... I am able to test the SMTP server from the internet thru the PIX and also ...
      (microsoft.public.isa.configuration)
    • CSS cant talk to array members in workgroup config
      ... We have a single NIC ISA 2006 SP1 server sitting on a DMZ network of our PIX. ... The CSS is on the internal network. ...
      (microsoft.public.isa.enterprise)
    • PIX firewall config question
      ... I'm not sure if this is even possible with a PIX, ... is a private 192.168.1/24 network and the outside is a public network ... Is it possible for outside and DMZ to be on the same IP ... everything is done through translations (port translation, ...
      (comp.security.firewalls)
    • Re: Design Help
      ... The second PIX can just be put on the network and the new DMZ ... connections we need can be hooked up that way. ...
      (comp.dcom.sys.cisco)
    • Re: [fw-wiz] Rationale of the great DMZ
      ... >DMZ and its implied security has changed. ... Network activity wouldn't ... >necessarily begin from the DMZ and be tunneled in to the internal network. ... >Commonly SSL accelerators terminate the SSL end point prior to the ...
      (Firewall-Wizards)