Re: [fw-wiz] PIX question






Brian Loe wrote on 11/03/2006 08:42:18 AM:


You have an smtp box on dmz2. You have rules in dmz2-in allowing the
smtp box to talk to boxes on the internal network. The smtp box can
NOT talk to anything on the internet - gets denied by dmz2-in ACL. Add
an any any rule for that host in dmz2-in and it works.

Question: Why would the inbound ACL on dmz2 prevent it from sending
traffic to the outside interface with a lower security setting? Does
an ACL applied to a dmz interface have an implied deny all - even for
lower security interfaces?

No, as soon as you apply an access-list to any interface it takes
precedence over the security levels.

Take the access-list away and yes it will pass to a lower level.


**********************************************************************
This e-mail and any files transmitted with it may contain
confidential information and is intended solely for use by
the individual to whom it is addressed. If you received
this e-mail in error, please notify the sender, do not
disclose its contents to others and delete it from your
system.

**********************************************************************

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxx
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: How to read and write information in internet
    ... Normally e-mail is handled via SMTP. ... Web mail typically sits over the SMTP using a web-based interface, ... > creates an account the software must creates an individual folder and ...
    (microsoft.public.vb.winapi)
  • Re: Migrate email to VMS server
    ... > Has anybody figured out how to import SMTP mail, headers and all, into VMS mail? ... need to configure SITE Transport Interface either as you will ... The documentation is excellent: ...
    (comp.os.vms)
  • Need to route SMTP traffic through static interface (not default route)
    ... Due to more cases of outbound SMTP traffic getting refused connections ... After some searching on here and Google I thought a route-map might do ... set interface Dialer0 ...
    (comp.dcom.sys.cisco)
  • Re: Binding A Server To A Specific IP Address
    ... Are you saying if my smtp server's public address is 65.2.1.55 then I should ... Even though the smtp server is ... Then define a network on ISA containing the IP ... Assign the public IP to the wan interface on ISA. ...
    (microsoft.public.isaserver)