PIX 501 DMZ to Internal Hosts Ports

Posted on 2006-05-06
Last Modified: 2010-04-09
My current setup is a router performing NAT to servers on a DMZ.  It looks like this:  router>switch>DMZ Hosts (192.168.88.X).   The router has an internal interface ip address of  I just put in a 501 PIX coming off the switch with E0 and E1 and a route statement of 0 0  I want to move most of my serves into the 192.168.100.X subnet behind the PIX leaving only a few servers in the DMZ, hosts,,, and respectively.  I need to have these DMZ hosts to talk to specific internal hosts through certain ports.  A few questions:

1.)  First question should I disable NAT on the PIX since the router is already NATing?

2.)  Second, will I be using port forwarding or simple static xlation statements with access lists?  (I really don't understand the difference)

Here is a sample of what I would like to do:

Protocol TCP Source Destination Port 7815
static (inside,outside) netmask
access-list DMZ permit tcp host host eq 7815
access-group dmz in interface outside

Will this work?

Much help is appreciated since I need to configure this by today.  Thanks
Question by:lewylupo
    LVL 79

    Expert Comment

    1) Yes, you can disable nat with a static network statement:
     static (inside,outside) netmask

    2) with the above static network nat, you will still need an acl just like you have, applied to the interface just like you show.

    Author Comment

    I've added the exact statement from my previous post and it did not work...

    static (inside,outside) netmask
    access-list DMZ permit tcp host host eq 7815
    access-group dmz in interface outside

    what am i missing?
    LVL 79

    Accepted Solution

    > E1
    >static (inside,outside) netmask
    You do not have 192.168.1.xx on the inside. You have 192.168.100.x

    try this:
     no static (inside,outside) netmask
     static (inside,outside) netmask

    Author Comment

    DUH!!!  Thanks for you help...its working now

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
    Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now