Cisco Pix 515E inside->dmz help

[MManquen]

Hi guys,

I am trying to set up our Cisco 515E Firewall so that the inside HTTP clients can access the FTP/Web server on our DMZ. I've followed the getting started guide but I can't figure out how to get it to work right. Inside -> outside access works, as does dmz -> outside, but inside -> dmz (and vice versa) doesn't. Any help would be much appreciated!

inside: 192.168.2.0
outside: 67.100.x.x
dmz (only one computer): 10.10.10.10

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
enable password xxx encrypted
passwd xx encrypted
hostname pixfirewall
domain-name gigapix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
..
fixup protocol tftp 69
names
name 67.100.x.226 ip1
object-group service ftp tcp
port-object eq ftp-data
port-object eq ftp
access-list inside_access_in permit tcp any any
access-list inside_access_in permit udp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit tcp any any eq ftp
access-list outside_access_in permit tcp any eq www host 67.100.x.227
access-list dmz_access_in permit tcp any any
access-list dmz_access_in permit udp any any
access-list dmz_access_in permit icmp any any
access-list dmz_access_in permit ip any any
access-list nonat permit ip 192.168.0.0 255.255.0.0 host 10.10.10.10
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside dhcp setroute retry 4
ip address inside 192.168.2.254 255.255.255.0
ip address dmz 10.10.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging debugging 100
pdm history enable
arp timeout 14400
global (outside) 200 interface
global (dmz) 200 10.10.10.10
nat (inside) 0 access-list nonat
nat (inside) 200 192.168.2.0 255.255.255.0 0 0
static (dmz,outside) 67.100.193.227 10.10.10.10 netmask 255.255.255.255 0 0
static (dmz,inside) 67.100.193.227 10.10.10.10 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 67.100.193.225 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.8 255.255.255.255 inside
http 192.168.2.38 255.255.255.255 inside
http 10.10.10.10 255.255.255.255 dmz
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.2.38 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.2.100-192.168.2.150 inside
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:9e98b659db511d647b6a644ff9cbeab3
: end
[OK]

Thanks again!

 

[Buzzons]

Surly that breaks the entire purpose of the DMZ? and also you will need a router to route between the two ip ranges...

 

[Zakkas]

I think it may be a NAT issue on your static. Try this

Leave your DMZ static to outside command but remove the dmz to inside static map.

add this:

static (inside,dmz) 10.10.10.10 192.168.2.x (where x is an available address on your LAN) netmask 255.255.255.255 0 0

access-list nonat permit ip host 192.168.2.x (where x is what you mapped it to above) host 10.10.10.10
access-list nonat permit ip 192.168.2.0 255.255.0.0 host 10.10.10.10

Also add:

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

and remove:

no nat (inside) 200 192.168.2.0 255.255.255.0


See if this solves your issue. Make sure you save the current configuration first.

 

[Aardon]

This is a really old topic but I ran into it so answering this may help someone else.

Honestly there are a bunch of issues with this config. Its pretty ugly. But there is one line that is breaking what you are trying to do.

!
global (dmz) 200 10.10.10.10
!

You are assigning the global address on the DMZ the same address as your server. Since they have the same address they can't communicate.

!
no global (dmz) 200 10.10.10.10
!
global (dmz) 200 interface
!

that would fix this issue and let your inside hosts access your server on the DMZ. The DMZ server would not be able to initiate a connection to systems on the inside.

If this wasn't over 2 years old I would rewrite your entire config for you.

 

[jthimmes78]

I have experienced the same issue with my PIX, yeah I know it's what we still use, We an ugly but extensive config, our DMZ is F'd up, the Net Admin before if you want to call him that, deiced to put an internal NIC leading back into the internal network from the DMZ which completely defeats the purpose. If any one still reads this I greatly appreciate any assistance
-Jay