Re: [fw-wiz] PIX 515E config - DMZ host to inside host



you need a translation and an acl entry permitting it. You can either do a
nat0 (bypass nat) or a static. Looking at your config your are doing mainly
PAT and statics. I would recommend doing nat0 internally between you
private IP space.

Looking at your config they really need to be reworked. First start by
redoing your translations. You have port redirection, pat, static nats, etc
without any real IP schema (ie reserved blocks for static nating). Secondly
your acl's need alot of work such as you have duplicate entries (such as in
the dmz) and no real egress filtering (among other things). These are just
a few things but I digress.

But if you would like a quick fix using your current schema. then:

static (internal,dmz) 10.134.x.x 10.133.24.3 netmask 255.255.255.255 0 0
(replace x's to what you want it to xlate to)

access-list acl_dmz3 permit ip host 10.134.1.2 host
10.134.x.x<http://10.133.24.3/>
<http://10.133.24.3/>
Kevin


On 2/27/07, Chris Mitchell <sw@xxxxxxxxxxxxxx> wrote:

Greetings folks,

PIX newbie here, not really a firewall guy but need to get some stuff done
with it, and am pretty good at basic configs. I have a 515E with 3
interfaces (inside, outside, DMZ)- I need to allow access from a host in
the DMZ to an internal host.

DMZ host - 10.134.1.2
Internal host - 10.133.24.3

I've done a few things, but after a few days of spinning my wheels I
thought I'd seek advice :)

Some info omitted for security reasons.

PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 internal security50
nameif ethernet2 dmz security30
enable password xxx
passwd xxx
hostname xxx
domain-name xxx
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol domain 53
fixup protocol rtsp 8554
fixup protocol rtsp 7000
fixup protocol rtsp 7001
names
access-list acl_in6 permit ip host 10.133.100.208 any
access-list acl_in6 permit ip host 10.133.100.209 any
access-list acl_in6 permit ip host 10.133.100.207 any
access-list acl_in6 permit ip host 10.133.100.206 any
access-list acl_in6 permit ip host 10.133.100.129 any
access-list acl_in6 permit ip 10.133.100.0 255.255.255.0 host 10.134.1.1
access-list acl_in6 permit ip 10.133.25.0 255.255.255.0 host 10.134.1.1
access-list acl_in6 permit ip 10.133.24.0 255.255.255.0 host 10.134.1.1
access-list acl_in6 permit ip host 10.133.100.205 any
access-list acl_in6 permit ip 10.133.100.0 255.255.255.0 any
access-list acl_in6 permit ip 10.133.24.0 255.255.255.0 host 10.134.1.2
access-list acl_in6 permit ip host 10.134.1.2 host 10.133.24.3
access-list acl_out3 permit tcp any host 203.xx.xxx.xxx eq smtp
access-list acl_out3 permit tcp any host 203.xx.xxx.xxx eq www
access-list acl_out3 permit tcp any host 203.xx.xxx.xxx eq 1352
access-list acl_dmz3 permit tcp host 10.134.1.1 host 10.134.1.207 eq smtp
access-list acl_dmz3 permit ip host 10.134.1.2 host 10.133.24.3
access-list acl_dmz3 permit tcp host 10.134.1.2 host 10.133.24.3
access-list acl_dmz3 permit udp host 10.134.1.2 host 10.133.24.3
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap warnings
logging host internal 10.133.25.4
logging host internal 10.133.25.3
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 10full
icmp deny any echo outside
icmp permit 10.133.25.0 255.255.255.0 echo dmz
icmp permit 10.134.1.0 255.255.255.0 echo dmz
mtu outside 1500
mtu internal 1500
mtu dmz 1500
ip address outside 203.xx.xxx.xxx 255.255.255.248
ip address internal 10.133.100.210 255.255.255.0
ip address dmz 10.134.1.129 255.255.255.0
ip audit name infopolicy info action alarm
ip audit name attackpolicy info action alarm drop
ip audit interface outside infopolicy
ip audit info action alarm
ip audit attack action alarm
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 10.134.1.130 netmask 255.255.255.0
nat (internal) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
static (dmz,outside) tcp interface www 10.134.1.1 www netmask
255.255.255.255 10 10
static (internal,dmz) tcp 10.134.1.5 1352 10.133.25.5 1352 netmask
255.255.255.255 0 0
static (internal,dmz) tcp 10.134.1.6 1352 10.133.25.6 1352 netmask
255.255.255.255 0 0
static (dmz,outside) tcp interface 1352 10.134.1.1 1352 netmask
255.255.255.255 10 10
static (internal,dmz) tcp 10.134.1.10 1352 10.133.24.10 1352 netmask
255.255.255.255 0 0
static (internal,outside) tcp interface smtp 10.133.100.207 smtp netmask
255.255.255.255 0 0
static (internal,dmz) tcp 10.134.1.207 smtp 10.133.100.207 smtp netmask
255.255.255.255 0 0
static (internal,dmz) 10.133.24.0 10.134.1.0 netmask 255.255.255.0 0 0
access-group acl_out3 in interface outside
access-group acl_in6 in interface internal
access-group acl_dmz3 in interface dmz
route outside 0.0.0.0 0.0.0.0 203.xx.xxx.xxx 1
route internal 10.133.0.0 255.255.0.0 10.133.100.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.133.100.0 255.255.255.0 internal
http 10.133.25.0 255.255.255.0 internal
floodguard enable
no sysopt route dnat
telnet timeout 30
ssh 10.133.100.208 255.255.255.255 internal
ssh 10.134.1.1 255.255.255.255 internal
ssh 10.133.24.0 255.255.255.0 internal
ssh 10.133.0.0 255.255.0.0 internal
ssh 10.133.100.208 255.255.255.255 dmz
ssh 10.133.100.0 255.255.255.0 dmz
ssh 10.134.1.1 255.255.255.255 dmz
ssh timeout 30
terminal width 80
Cryptochecksum:9c355bdae4a42aa97de9f3d2c77559a3

Regards,

Chris Mitchell


_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


Relevant Pages

  • PIX VPN mesh with acess to multiple subnets at one of the sites?
    ... packet Databases' and then ping a host on the Databases VLAN at Central from ... fixup protocol dns maximum-length 512 ... access-group outside_acl in interface outside ... vpdn group PPTP-VPDN-GROUP ppp authentication mschap ...
    (comp.dcom.sys.cisco)
  • Re: [fw-wiz] PIX 515E config - DMZ host to inside host
    ... access-list permit_dmz_inside permit ip 10.134.1.2 255.255.255.255 ... access-list acl_in6 permit ip host 10.134.1.2 host 10.133.24.3 ... fixup protocol http 80 ... access-group acl_out3 in interface outside ...
    (Firewall-Wizards)
  • Re: [fw-wiz] PIX 515E config - DMZ host to inside host
    ... the DMZ to an internal host. ... fixup protocol http 80 ... access-list acl_in6 permit ip host 10.133.100.208 any ... access-group acl_out3 in interface outside ...
    (Firewall-Wizards)
  • Re: Lose internet access when vpn enabled cisco 501
    ... access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 ... fixup protocol dns maximum-length 512 ... access-group outside_access_in in interface outside ... aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable ...
    (comp.dcom.sys.cisco)
  • [fw-wiz] PIX 515E config - DMZ host to inside host
    ... the DMZ to an internal host. ... fixup protocol http 80 ... access-list acl_in6 permit ip host 10.133.100.208 any ... access-group acl_out3 in interface outside ...
    (Firewall-Wizards)