Solved

Can I allow traffic from an inside network host to a dmz host on my pix 515 using 6.3(5)?

Posted on 2006-11-10
5
249 Views
Last Modified: 2010-04-10
I have a server sitting on a dmz network, 192.168.10.2, which has a natted address and is available to the outside/internet.  However, I'd like to be able to get to it from my computer on the internal network, but I can't so far.  I need to open tcp port 3389 for terminal services access, and was going to add icmp while I was at it so I can ping the server.  Neither works, however - the dmz interface is security10, while the internal interface is security100, and the external interface to the internet is security100.  I used conduit statements like 'conduit permit tcp host 192.168.10.2 eq 3389 host (my ip address on the internal network), which didn't work, so I then tried 'conduit permit tcp host (my ip address on the internal network) eq 3389 192.168.10.2', which didn't work either.

Any suggestions how I can do this?  Thanks in advance!
0
Comment
Question by:atyar
  • 3
  • 2
5 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 17918468
All you need is a nat static
What is your Internal LAN subnet? example using 192.168.9.0 for internal:
 
static (inside,dmz) 192.168.9.0 192.168.9.0 netmask 255.255.255.0

Nat same same, inside to dmz
You should not need conduit for higher to lower inside to dmz
0
 
LVL 2

Author Comment

by:atyar
ID: 17929795
Ok that works, but I'm a little confused as to why.  Why create a nat statement that doesn't change the address for the other network?
0
 
LVL 2

Author Comment

by:atyar
ID: 17929810
b.t.w. typo above I just noticed - internet interface is security 0, not 100 :)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17933344
Because it is just the design of the PIX. It is designed as a firewall and not a router. It does not simply route packets between interfaces. There has to be NAT applied to all traffic between interfaces of different security levels and in this context we just nat the original to the same subnet
In PIX 7.x we can use a command "nat control" and "no nat control" to turn on/off this requirement.
0
 
LVL 2

Author Comment

by:atyar
ID: 17938577
Well, give a man a fish, and he eats for a day.  Teach a man to fish, and he eats for a lifetime.
Thanks for the tutelage..... :)
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Resolve DNS query failed errors for Exchange
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now