Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Can I allow traffic from an inside network host to a dmz host on my pix 515 using 6.3(5)?

Posted on 2006-11-10
5
Medium Priority
?
257 Views
Last Modified: 2010-04-10
I have a server sitting on a dmz network, 192.168.10.2, which has a natted address and is available to the outside/internet.  However, I'd like to be able to get to it from my computer on the internal network, but I can't so far.  I need to open tcp port 3389 for terminal services access, and was going to add icmp while I was at it so I can ping the server.  Neither works, however - the dmz interface is security10, while the internal interface is security100, and the external interface to the internet is security100.  I used conduit statements like 'conduit permit tcp host 192.168.10.2 eq 3389 host (my ip address on the internal network), which didn't work, so I then tried 'conduit permit tcp host (my ip address on the internal network) eq 3389 192.168.10.2', which didn't work either.

Any suggestions how I can do this?  Thanks in advance!
0
Comment
Question by:atyar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 1000 total points
ID: 17918468
All you need is a nat static
What is your Internal LAN subnet? example using 192.168.9.0 for internal:
 
static (inside,dmz) 192.168.9.0 192.168.9.0 netmask 255.255.255.0

Nat same same, inside to dmz
You should not need conduit for higher to lower inside to dmz
0
 
LVL 2

Author Comment

by:atyar
ID: 17929795
Ok that works, but I'm a little confused as to why.  Why create a nat statement that doesn't change the address for the other network?
0
 
LVL 2

Author Comment

by:atyar
ID: 17929810
b.t.w. typo above I just noticed - internet interface is security 0, not 100 :)
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17933344
Because it is just the design of the PIX. It is designed as a firewall and not a router. It does not simply route packets between interfaces. There has to be NAT applied to all traffic between interfaces of different security levels and in this context we just nat the original to the same subnet
In PIX 7.x we can use a command "nat control" and "no nat control" to turn on/off this requirement.
0
 
LVL 2

Author Comment

by:atyar
ID: 17938577
Well, give a man a fish, and he eats for a day.  Teach a man to fish, and he eats for a lifetime.
Thanks for the tutelage..... :)
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Make the most of your online learning experience.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question