Re: [fw-wiz] Extreme Problem with PIX Config

From: John Dorsey (dorsey_at_colquitt.org)
Date: 05/13/05

  • Next message: Brian Loe: "RE: [fw-wiz] Extreme Problem with PIX Config" 
    To: Brian Loe <knobdy@stjoelive.com>
Date: Fri, 13 May 2005 10:13:39 -0500

    Brian,

    > I've been fighting this problem for two weeks now. What follows is the
    > current config (edited to protect the innocent). If format is maintained,
    > the trouble lines will be bolded. These trouble lines are: access-list nonat
    > permit ip any any; nat (inside) 0 access-list nonat; access-group nonat in
    > interface dmz.
    [lots of deletia]

            Here's a couple of ideas and recommendations that may help.
    First, I don't recommend using the same acl for the "access-group" and
    "nat (interface) 0 ..." purposes; keep those acl's separate and things
    are cleaner.

            Second, I recommend applying an acl to every interface with
    "access-group". That way no access is implied by security levels;
    everything's explicit. Your mileage and tastes may vary.

            Third, if you need non-natted access between some pair of
    interfaces (say, inside and DMZ), then write a nonat acl for the
    interface with the higher security level, permitting all ip from the
    higher-security level subnet (source) to the lower-security level subnet
    (destination). Note that it doesn't matter whether the packets and
    connections are sourced from the higher or lower interface... for nat
    purposes the higher security interface is written as source by
    convention.

            So try something like this: (untested) (pardon the long line)

    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 DMZ security4
    ip address outside ip.pub.nt.126 255.255.255.224
    ip address inside 10.100.0.3 255.255.254.0
    ip address DMZ 192.168.1.1 255.255.255.0
    access-list acl_inbound <whatever>
    access-list acl_dmz <whatever>
    access-list acl_inside <whatever>
    access-group acl_inbound in interface outside
    access-group acl_dmz in interface DMZ
    access-group acl_inside in interface inside
    access-list acl_nonat_inside permit ip 10.100.0.0 255.255.254.0 192.168.1.0 255.255.255.0
    nat (inside) 0 access-list acl_nonat_inside

            Traffic that matches acl_nonat_inside (i.e. traffic between
    inside and DMZ) will go un-natted; all other traffic (including Internet
    traffic) will be natted.

    Cheers,
    John

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Brian Loe: "RE: [fw-wiz] Extreme Problem with PIX Config"

    Relevant Pages

    • Re: Help! DMZ on Pix515
      ... I was of course missing static routes to the DMZ. ... interface Ethernet0 ... access-list inside_access_out extended permit tcp 0.0.0.0 255.255.255.0 ... access-group outside_access_in in interface outside ...
      (comp.dcom.sys.cisco)
    • Re: Help! DMZ on Pix515
      ... I can't reach anything on the DMZ from the outside. ... interface Ethernet0 ... access-list inside_access_out extended permit tcp 0.0.0.0 255.255.255.0 ... access-group outside_access_in in interface outside ...
      (comp.dcom.sys.cisco)
    • Re: [fw-wiz] PIX access-list help
      ... Easiest thing to remember is any communication is allowed from a higher ... DMZ, DMZ to outside) unless explicitly prevented. ... You create an ACL and apply it either in or out of the interface. ... are applied "access-group out interface blah". ...
      (Firewall-Wizards)
    • Re: new to cisco asa 5505
      ... communication between the DMZ VLAN and the Inside ... interface Vlan1 ... access-group outside_access_in in interface outside ...
      (comp.dcom.sys.cisco)
    • [fw-wiz] RE: PIX 520 - control traffic between DMZ and inside devices
      ... limit access for traffic initiated in the DMZ to only certain machines/ports ... access-list dmz_in permit tcp host my.DMZ.net.37 host my.PRIVATE.net.9 eq ... access-group dmz_in in interface DMZ ...
      (Firewall-Wizards)