WMfxms
asked on
WEB ACCESS FROM DMZ THROUGH PIX FIREWALL
I have a strange problem in that i have 3 servers sat on the DMZ which can all access the web ok. I have added another, but although this can ping the local network and can be accessed externally i can not get the server to access the web.
The pix is connected to a linkproof loadbalancer, but there are not access rules set on this unit.
I can see in the log of the loadbalancer that the ip address of the server is getting through to it, but does not make it as far as the router. or so it seems.
The server is added to the pix as a host and all rules are host based, so i shouldnt need to add any extra rules to the access list.
If i take down one of the servers and use this ip addres on the new server it works fine.
I can only assume that there is a problem with the firewall in that it is not letting something through somewhere.
access-list dmz_access_in permit ip host HOST1-1 255.255.255.0
access-list dmz_access_in permit ip host HOST2-1 255.255.255.0
access-list dmz_access_in permit ip host HOST3-1 255.255.255.0
access-list dmz_access_in permit ip host HOST4-1 255.255.255.0
access-list dmz_access_in permit tcp host HOST1 any eq smtp
access-list dmz_access_in permit ip any any
access-list dmz_access_in permit tcp any any
The pix is connected to a linkproof loadbalancer, but there are not access rules set on this unit.
I can see in the log of the loadbalancer that the ip address of the server is getting through to it, but does not make it as far as the router. or so it seems.
The server is added to the pix as a host and all rules are host based, so i shouldnt need to add any extra rules to the access list.
If i take down one of the servers and use this ip addres on the new server it works fine.
I can only assume that there is a problem with the firewall in that it is not letting something through somewhere.
access-list dmz_access_in permit ip host HOST1-1 255.255.255.0
access-list dmz_access_in permit ip host HOST2-1 255.255.255.0
access-list dmz_access_in permit ip host HOST3-1 255.255.255.0
access-list dmz_access_in permit ip host HOST4-1 255.255.255.0
access-list dmz_access_in permit tcp host HOST1 any eq smtp
access-list dmz_access_in permit ip any any
access-list dmz_access_in permit tcp any any
Do you have static xlates for these servers? You probably need another static for this new server
ASKER
I am awaiting feedback from Radware on the load balancer as the firewall seems to be configured ok. I am getting an entry on the loadbalancer, so i know the request is going through the firewall ok. It just doesnt make it to the router....
(As an aside, we used to have Radware Linkproof LB's. Tons of problems. Yanked them out and replaced with two beefy Cisco routers running BGP to two different ISP's who we peer with. No problems since then. All our Radware has gone away - Linkproofs, WSD's, Fireproofs).
ASKER
Sorted - was a problem with linkproof
Go figure. :| Glad you got it working.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
HTH