[fw-wiz] Transparent DMZ



I am trying to use a cisco 2621 router as a firewall, it should have
an outside, inside and dmz, the dmz should be able to use public ips
on the machines behind it. If anyone is familiar with sonicwalls, just
like a sonicwall transparent dmz.

Currently what i have done is made my 3 interfaces, set ips on the
outside and inside, then bridged with irb bridging the outside and dmz
interfaces. the inside interface works fine however the dmz does not
seem to be able to pass traffic(at one point in time while i was
configuring this it did work, i just cant pinpoint when).
38.102.248.179 is my dmz host, and it can not get out to the internet
or receive connections.

thank you

!
bridge irb
!
!
!
interface FastEthernet0/0
description outside
ip address 38.102.248.178 255.255.255.248
ip access-group outside_access_in in
ip nat outside
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
!
interface FastEthernet0/1
description inside/dmz
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.10
description inside
encapsulation dot1Q 10
ip address 172.21.16.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/1.11
description dmz
encapsulation dot1Q 11
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
no ip address
!
ip nat inside source list nat interface FastEthernet0/0 overload
!
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 38.102.248.177
!
ip access-list standard nat
permit 172.21.16.0 0.0.0.255
!
ip access-list extended outside_access_in
permit tcp any any established
permit icmp any any
permit tcp any host 38.102.248.179
permit tcp any host 38.102.248.178 eq www
permit tcp any host 38.102.248.178 eq 4125
permit tcp any host 38.102.248.178 eq 5900
permit tcp any host 38.102.248.178 eq 443
permit tcp any host 38.102.248.178 eq 444
permit tcp 208.65.144.0 0.0.7.255 host 38.102.248.178 eq smtp
permit tcp 208.81.64.0 0.0.3.255 host 38.102.248.178 eq smtp
permit udp any eq domain any
permit tcp any eq domain any
!
!

--
-Lawrence
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards