Advertisement

09.05.2008 at 08:18AM PDT, ID: 23706545
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
9.1

Cannot Access DMZ Webservers from Outside

Asked by MJBrenner in Cisco PIX Firewall

Tags: ,

I am setting up a DMZ for my network. I can access the DMZ from inside, but not from outside.
What am I mising>

Here is my config:

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
enable password XXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXX encrypted
hostname XXXXX
domain-name XXXXXXXXXXXXXX
names
object-group service Terminal tcp
  port-object range 3389 3389
object-group service pcanywhere tcp
  port-object eq pcanywhere-data
object-group service Std-Web tcp
  port-object eq www
  port-object eq ssh
  port-object eq ftp-data
  port-object eq ftp
  port-object eq https
object-group service Term-Pca tcp
  group-object pcanywhere
  group-object Terminal
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 102 permit tcp any host 68.167.245.5 eq domain
access-list 102 permit tcp any host 68.167.245.8 object-group Std-Web
access-list 102 permit tcp any host 68.167.245.3 object-group Std-Web
access-list 102 permit tcp any host 68.167.245.8 eq 3389
access-list 102 permit udp any host 68.167.245.5 eq domain
access-list 102 permit icmp any host 68.167.245.4
access-list 102 permit tcp any host 68.167.245.4 eq https
access-list 102 permit tcp any host 68.167.245.4 eq www
access-list 102 permit tcp any host 68.167.245.10 object-group Terminal
access-list 102 permit tcp 64.18.0.0 255.255.240.0 host 68.167.245.4 eq smtp
access-list 102 permit tcp any host 68.167.245.11 object-group Term-Pca
access-list 102 permit tcp any host 68.167.245.4 eq imap4
access-list 102 permit tcp any host 68.167.245.4 eq smtp
access-list 103 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 104 permit tcp any host 68.167.245.7 object-group Std-Web
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 68.167.245.2 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip address dmz 192.168.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 192.168.2.10-192.168.2.20
ip local pool IPSec-pool 192.168.2.21-192.168.2.30
global (outside) 1 68.167.245.14
global (dmz) 1 192.168.10.20
nat (inside) 0 access-list 103
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 68.167.245.3 192.168.1.2 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.8 192.168.1.222 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.5 192.168.1.11 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.4 192.168.1.4 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.11 192.168.1.82 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.10 192.168.1.10 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.12 192.167.1.175 netmask 255.255.255.255 0 0
static (inside,outside) 68.167.245.6 192.168.1.160 netmask 255.255.255.255 0 0
static (dmz,outside) 68.167.245.7 192.168.10.8 netmask 255.255.255.255 0 0
access-group 102 in interface outside
route outside 0.0.0.0 0.0.0.0 68.167.245.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community usw3b
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac
crypto dynamic-map map2 10 set transform-set esp-des-md5
crypto map map1 10 ipsec-isakmp dynamic map2
crypto map map1 interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpnAdmin address-pool IPSec-pool
vpngroup vpnAdmin dns-server 192.168.1.11
vpngroup vpnAdmin default-domain uswebinc.com
vpngroup vpnAdmin idle-time 1800
vpngroup vpnAdmin password ********
vpngroup vpnadmin split-tunnel 101
vpngroup vpnadmin idle-time 1800
telnet 192.168.1.105 255.255.255.255 inside
telnet 192.168.1.11 255.255.255.255 inside
telnet 192.168.1.175 255.255.255.255 inside
telnet timeout 30
ssh 204.238.217.0 255.255.255.0 outside
ssh 63.116.176.0 255.255.255.0 outside
ssh timeout 5
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 client configuration dns 192.168.1.11
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd lease 3600
dhcpd ping_timeout 750

*************************

Thanks in AdvanceStart Free Trial
[+][-]09.05.2008 at 08:36AM PDT, ID: 22400121

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]09.05.2008 at 08:43AM PDT, ID: 22400219

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]09.05.2008 at 12:47PM PDT, ID: 22403007

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]09.05.2008 at 02:34PM PDT, ID: 22404042

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]09.05.2008 at 03:43PM PDT, ID: 22404454

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]09.05.2008 at 04:19PM PDT, ID: 22404580

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zone: Cisco PIX Firewall
Tags: Cosco, PIX 515
Sign Up Now!
Solution Provided By: lrmoore
Participating Experts: 2
Solution Grade: A
 
 
[+][-]09.05.2008 at 04:20PM PDT, ID: 22404586

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628