Solved

WEB ACCESS FROM DMZ THROUGH PIX FIREWALL

Posted on 2006-10-30
8
250 Views
Last Modified: 2013-11-16
I have a strange problem in that i have 3 servers sat on the DMZ which can all access the web ok. I have added another, but although this can ping the local network and can be accessed externally i can not get the server to access the web.

The pix is connected to a linkproof loadbalancer, but there are not access rules set on this unit.

I can see in the log of the loadbalancer that the ip address of the server is getting through to it, but does not make it as far as the router. or so it seems.

The server is added to the pix as a host and all rules are host based, so i shouldnt need to add any extra rules to the access list.

If i take down one of the servers and use this ip addres on the new server it works fine.

I can only assume that there is a problem with the firewall in that it is not letting something through somewhere.


access-list dmz_access_in permit ip host HOST1-1 255.255.255.0
access-list dmz_access_in permit ip host HOST2-1 255.255.255.0
access-list dmz_access_in permit ip host HOST3-1 255.255.255.0
access-list dmz_access_in permit ip host HOST4-1 255.255.255.0
access-list dmz_access_in permit tcp host HOST1 any eq smtp
access-list dmz_access_in permit ip any any
access-list dmz_access_in permit tcp any any












0
Comment
Question by:WMfxms
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 27

Expert Comment

by:pseudocyber
ID: 17833122
Do you have firewall rules disallowing access out?  This is the way we do it - and think it's a good design.  Since you said all the rules are host based, if you did it this way, you'd have to add an outbound rule as well.  To get around such minute administration, we recognize the DMZ net as trusted and have a rule which allows port 80 outbound from the DMZ net, instead of each individual server.

HTH
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17833131
Do you have static xlates for these servers? You probably need another static for this new server
0
 

Author Comment

by:WMfxms
ID: 17840936
I am awaiting feedback from Radware on the load balancer as the firewall seems to be configured ok. I am getting an entry on the loadbalancer, so i know the request is going through the firewall ok. It just doesnt make it to the router....

0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 27

Expert Comment

by:pseudocyber
ID: 17841256
(As an aside, we used to have Radware Linkproof LB's.  Tons of problems.  Yanked them out and replaced with two beefy Cisco routers running BGP to two different ISP's who we peer with.  No problems since then.  All our Radware has gone away - Linkproofs, WSD's, Fireproofs).
0
 

Author Comment

by:WMfxms
ID: 17989379
Sorted - was a problem with linkproof
0
 
LVL 27

Expert Comment

by:pseudocyber
ID: 17989951
Go figure.  :|  Glad you got it working.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 23053148
PAQed with no points refunded (of 500)

Computer101
EE Admin
0

Featured Post

WordPress Tutorial 4: Recommended Plugins

Now that you have WordPress installed, understand the interface, and know how to install new parts, let’s take a look at our recommended plugins.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question