Cisco Pix 515E inside->dmz help

Hi guys,

I am trying to set up our Cisco 515E Firewall so that the inside HTTP clients can access the FTP/Web server on our DMZ. I've followed the getting started guide but I can't figure out how to get it to work right. Inside -> outside access works, as does dmz -> outside, but inside -> dmz (and vice versa) doesn't. Any help would be much appreciated!

outside: 67.100.x.x
dmz (only one computer):

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
enable password xxx encrypted
passwd xx encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol tftp 69
name 67.100.x.226 ip1
object-group service ftp tcp
port-object eq ftp-data
port-object eq ftp
access-list inside_access_in permit tcp any any
access-list inside_access_in permit udp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit tcp any any eq ftp
access-list outside_access_in permit tcp any eq www host 67.100.x.227
access-list dmz_access_in permit tcp any any
access-list dmz_access_in permit udp any any
access-list dmz_access_in permit icmp any any
access-list dmz_access_in permit ip any any
access-list nonat permit ip host
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside dhcp setroute retry 4
ip address inside
ip address dmz
ip audit info action alarm
ip audit attack action alarm
pdm logging debugging 100
pdm history enable
arp timeout 14400
global (outside) 200 interface
global (dmz) 200
nat (inside) 0 access-list nonat
nat (inside) 200 0 0
static (dmz,outside) netmask 0 0
static (dmz,inside) netmask 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group dmz_access_in in interface dmz
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
http inside
http dmz
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address inside
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
: end

Thanks again!
4 answers Last reply
More about cisco 515e inside help
  1. Surly that breaks the entire purpose of the DMZ? and also you will need a router to route between the two ip ranges...
  2. I think it may be a NAT issue on your static. Try this

    Leave your DMZ static to outside command but remove the dmz to inside static map.

    add this:

    static (inside,dmz) 192.168.2.x (where x is an available address on your LAN) netmask 0 0

    access-list nonat permit ip host 192.168.2.x (where x is what you mapped it to above) host
    access-list nonat permit ip host

    Also add:

    nat (inside) 1 0 0

    and remove:

    no nat (inside) 200

    See if this solves your issue. Make sure you save the current configuration first.
  3. This is a really old topic but I ran into it so answering this may help someone else.

    Honestly there are a bunch of issues with this config. Its pretty ugly. But there is one line that is breaking what you are trying to do.

    global (dmz) 200

    You are assigning the global address on the DMZ the same address as your server. Since they have the same address they can't communicate.

    no global (dmz) 200
    global (dmz) 200 interface

    that would fix this issue and let your inside hosts access your server on the DMZ. The DMZ server would not be able to initiate a connection to systems on the inside.

    If this wasn't over 2 years old I would rewrite your entire config for you. :-)
  4. I have experienced the same issue with my PIX, yeah I know it's what we still use, We an ugly but extensive config, our DMZ is F'd up, the Net Admin before if you want to call him that, deiced to put an internal NIC leading back into the internal network from the DMZ which completely defeats the purpose. If any one still reads this I greatly appreciate any assistance
Ask a new question

Read More

Firewalls FTP DMZ Cisco Networking