<div>
I'm not seeing the config ??
</div>

<div>
Sorry, it took me awhile to clean it. 
 
Building configuration... 
: Saved 
: 
PIX Version 6.3(4)120 
interface ethernet0 auto 
interface ethernet1 auto 
interface ethernet2 auto 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
nameif ethernet2 dmz security4 
enable password 
passwd 
hostname xxxxx-FW 
domain-name xxxxxx.com 
clock timezone CST -6 
clock summer-time CDT recurring 
fixup protocol dns maximum-length 512 
fixup protocol ftp 21 
fixup protocol h323 h225 1720 
fixup protocol h323 ras 1718-1719 
fixup protocol http 80 
fixup protocol rsh 514 
fixup protocol rtsp 554 
fixup protocol sip 5060 
fixup protocol sip udp 5060 
fixup protocol skinny 2000 
no fixup protocol smtp 25 
fixup protocol sqlnet 1521 
fixup protocol tftp 69 
no names 
name 10.71.40.0 Chicago 
name 10.71.42.128 Houston2 
name 192.168.1.0 PIX-to-Router 
name 10.71.42.0 Houston 
name 10.71.41.0 Philadelphia 
name x.x.x.128 vendor 
name 10.71.42.164 Exchange 
name 10.71.42.144 VBS 
name 10.71.42.125 xx-server 
name 10.71.42.150 image 
name 10.71.43.0 GrandRapids 
name 10.71.42.142 AVAYA 
name 10.71.42.13 dummy 
name 10.71.42.114 imaging 
name 10.71.44.0 LAX 
name 10.71.42.55 linux 
name x.x.x.52 Data_Center 
name 10.71.42.165 device 
object-group network PcAnywhere 
&nbsp; network-object 10.71.42.13 255.255.255.255 
object-group network PcAnywhere_ref 
&nbsp; network-object x.x.146.40 255.255.255.255 
access-list incoming deny icmp any any echo-reply 
access-list incoming permit tcp any host x.x.x.34 eq smtp 
access-list incoming permit tcp any eq pop3 host x.x.x.34 eq pop3 
access-list incoming deny tcp any host x.x.x.34 eq www 
access-list incoming permit tcp any host x.x.x.34 eq https 
access-list incoming deny tcp any object-group PcAnywhere_ref eq pcanywhere-data 
access-list incoming deny udp any object-group PcAnywhere_ref eq pcanywhere-status 
access-list incoming deny tcp any host x.x.x.39 eq telnet 
access-list incoming deny tcp host x.x.x.52 host x.x.x.35 
access-list dmz permit icmp any any 
access-list dmz permit ip host 10.71.42.164 10.71.40.0 255.255.255.0 
access-list dmz permit ip host 10.71.42.164 10.71.41.0 255.255.255.0 
access-list dmz permit ip host 10.71.42.164 10.71.42.0 255.255.255.128 
access-list dmz permit ip host 10.71.42.164 10.71.42.128 255.255.255.224 
access-list dmz permit ip host 10.71.42.164 10.71.43.0 255.255.255.0 
access-list dmz permit ip host 10.71.42.164 10.71.44.0 255.255.255.0 
access-list dmz permit tcp host 10.71.42.164 any eq www 
access-list dmz permit tcp host 10.71.42.164 any eq https 
access-list dmz permit udp host 10.71.42.164 any eq domain 
access-list dmz permit ip host 10.71.42.164 any 
access-list dmz permit ip any any 
access-list inside_outbound_nat0_acl permit ip any 192.168.0.0 255.255.255.128 
access-list dmz_outbound_nat0_acl permit ip any 192.168.0.0 255.255.255.128 
access-list dmz_outbound_nat0_acl permit ip 10.71.42.160 255.255.255.224 x.x.x.0 255.255.255.0 
access-list dmz_outbound_nat0_acl permit ip 10.71.42.160 255.255.255.224 x.x.x.0 255.255.255.0 
access-list outside_cryptomap_20 permit ip host 10.71.42.164 host x.x.x.100 
access-list outside_cryptomap_20 permit ip host 10.71.42.164 host x.x.x.101 
access-list outside_cryptomap_20 permit ip host 10.71.42.164 x.x.x.0 255.255.255.0 
pager lines 24 
logging on 
logging timestamp 
logging trap notifications 
logging host inside 10.71.42.50 
logging host inside 10.71.42.123 
icmp deny any outside 
mtu outside 1500 
mtu inside 1500 
mtu dmz 1500 
ip address outside x.x.x.62 255.255.255.0 
ip address inside 192.168.1.1 255.255.255.0 
ip address dmz 10.71.42.163 255.255.255.224 
ip audit name IncomingAlarm info action alarm 
ip audit name Incoming attack action alarm drop reset 
ip audit interface outside IncomingAlarm 
ip audit interface outside Incoming 
ip audit info action alarm 
ip audit attack action alarm drop reset 
ip local pool test 192.168.0.50-192.168.0.100 
pdm location 10.71.40.0 255.255.255.0 inside 
pdm location 10.71.41.0 255.255.255.0 inside 
pdm location 10.71.42.0 255.255.255.128 inside 
pdm location 10.71.42.128 255.255.255.224 inside 
pdm location 10.71.42.0 255.255.255.0 inside 
pdm location x.x.x.128 255.255.255.192 outside 
pdm location 10.71.42.50 255.255.255.255 inside 
pdm location 10.71.42.144 255.255.255.255 inside 
pdm location 10.71.42.164 255.255.255.255 dmz 
pdm location 10.71.42.125 255.255.255.255 inside 
pdm location 10.71.42.150 255.255.255.255 inside 
pdm location 10.71.43.0 255.255.255.0 inside 
pdm location x.x.x.120 255.255.255.255 outside 
pdm location 10.71.42.142 255.255.255.255 inside 
pdm location 10.71.42.13 255.255.255.255 inside 
pdm location 10.71.42.123 255.255.255.255 inside 
pdm location 10.71.42.114 255.255.255.255 inside 
pdm location 10.71.44.0 255.255.255.0 inside 
pdm location 0.0.0.0 255.255.255.224 outside 
pdm location 0.0.0.0 255.255.255.128 outside 
pdm location 10.71.42.55 255.255.255.255 inside 
pdm location 10.71.42.165 255.255.255.255 dmz 
pdm location x.x.x.52 255.255.255.255 outside 
pdm location 192.168.0.0 255.255.255.0 dmz 
pdm location 192.168.0.0 255.255.0.0 dmz 
pdm location 192.168.0.0 255.255.255.255 dmz 
pdm location 192.168.0.255 255.255.255.255 dmz 
pdm location 192.0.0.0 255.0.0.0 dmz 
pdm location 192.168.0.53 255.255.255.255 dmz 
pdm location 192.168.0.0 255.255.255.128 dmz 
pdm location 192.168.0.0 255.255.255.128 outside 
pdm location x.x.x.100 255.255.255.255 outside 
pdm location x.x.x.101 255.255.255.255 outside 
pdm location x.x.x.0 255.255.255.0 outside 
pdm location x.x.x.0 255.255.255.0 outside 
pdm location x.x.x.0 255.255.255.240 outside 
pdm group PcAnywhere inside 
pdm group PcAnywhere_ref outside reference PcAnywhere 
pdm logging notifications 100 
pdm history enable 
arp timeout 14400 
global (outside) 1 interface 
nat (inside) 0 access-list inside_outbound_nat0_acl 
nat (inside) 1 0.0.0.0 0.0.0.0 0 0 
nat (dmz) 0 access-list dmz_outbound_nat0_acl 
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0 
static (dmz,outside) x.x.x.34 10.71.42.164 netmask 255.255.255.255 0 0 
static (dmz,outside) x.x.x.35 10.71.42.165 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.36 10.71.42.55 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.37 10.71.42.144 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.38 10.71.42.150 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.39 10.71.42.142 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.40 10.71.42.13 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.41 10.71.42.114 netmask 255.255.255.255 0 0 
static (inside,outside) x.x.x.42 10.71.42.50 netmask 255.255.255.255 0 0 
static (inside,dmz) 10.71.40.0 10.71.40.0 netmask 255.255.255.0 0 0 
static (inside,dmz) 10.71.41.0 10.71.41.0 netmask 255.255.255.0 0 0 
static (inside,dmz) 10.71.43.0 10.71.43.0 netmask 255.255.255.0 0 0 
static (inside,dmz) 10.71.42.0 10.71.42.0 netmask 255.255.255.128 0 0 
static (inside,dmz) 10.71.42.128 10.71.42.128 netmask 255.255.255.224 0 0 
static (inside,dmz) 10.71.44.0 10.71.44.0 netmask 255.255.255.0 0 0 
access-group incoming in interface outside 
access-group dmz in interface dmz 
route outside 0.0.0.0 0.0.0.0 12.25.146.33 1 
route inside 10.71.40.0 255.255.255.0 192.168.1.254 1 
route inside 10.71.41.0 255.255.255.0 192.168.1.254 1 
route inside 10.71.42.0 255.255.255.128 192.168.1.254 1 
route inside 10.71.42.128 255.255.255.224 192.168.1.254 1 
route inside 10.71.43.0 255.255.255.0 192.168.1.254 1 
route inside 10.71.44.0 255.255.255.0 192.168.1.254 1 
timeout xlate 3:00:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
aaa authentication enable console LOCAL 
aaa authentication http console LOCAL 
aaa authentication serial console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication telnet console LOCAL 
aaa authorization command LOCAL 
http server enable 
http x.x.x.128 255.255.255.192 outside 
http 192.168.1.0 255.255.255.0 inside 
http 10.71.40.0 255.255.255.0 inside 
http 10.71.41.0 255.255.255.0 inside 
http 10.71.42.0 255.255.255.0 inside 
http 10.71.43.0 255.255.255.0 inside 
http 10.71.42.160 255.255.255.224 dmz 
no snmp-server location 
no snmp-server contact 
snmp-server community public 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
sysopt connection permit-pptp 
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto map outside_map 20 ipsec-isakmp 
crypto map outside_map 20 match address outside_cryptomap_20 
crypto map outside_map 20 set peer x.x.x.2 
crypto map outside_map 20 set transform-set ESP-3DES-SHA 
crypto map outside_map interface outside 
isakmp enable outside 
isakmp key ******** address x.x.x.2 netmask 255.255.255.255 
isakmp policy 20 authentication pre-share 
isakmp policy 20 encryption 3des 
isakmp policy 20 hash sha 
isakmp policy 20 group 2 
isakmp policy 20 lifetime 86400 
isakmp policy 40 authentication pre-share 
isakmp policy 40 encryption 3des 
isakmp policy 40 hash md5 
isakmp policy 40 group 2 
isakmp policy 40 lifetime 86400 
telnet 10.71.40.0 255.255.255.0 inside 
telnet 10.71.41.0 255.255.255.0 inside 
telnet 10.71.42.0 255.255.255.0 inside 
telnet 10.71.42.160 255.255.255.224 dmz 
telnet timeout 5 
ssh x.x.x.128 255.255.255.192 outside 
ssh x.x.x.0 255.255.255.240 outside 
ssh 192.168.1.0 255.255.255.0 inside 
ssh timeout 5 
console timeout 5 
vpdn group test accept dialin pptp 
vpdn group test ppp authentication mschap 
vpdn group test ppp encryption mppe 128 required 
vpdn group test client configuration address local test 
vpdn group test client configuration dns 10.71.42.125 
vpdn group test pptp echo 60 
vpdn group test client authentication local 
vpdn username jxxxxxxxi password ********* 
vpdn username xxxxxl password ********* 
vpdn username xxxxxxy password ********* 
vpdn enable outside 
username Jxxxxx password CVa1Qh7zf.f.uHxm encrypted privilege 15 
username isxxxxxx password .6c2js8QnRcpwZ2w encrypted privilege 15 
username cxxxxxxx password /7s2IWadUaE5i3.b encrypted privilege 15 
privilege show level 0 command version 
privilege show level 0 command curpriv 
privilege show level 3 command pdm 
privilege show level 3 command blocks 
privilege show level 3 command ssh 
privilege configure level 3 command who 
privilege show level 3 command isakmp 
privilege show level 3 command ipsec 
privilege show level 3 command vpdn 
privilege show level 3 command local-host 
privilege show level 3 command interface 
privilege show level 3 command ip 
privilege configure level 3 command ping 
privilege show level 3 command uauth 
privilege configure level 5 mode enable command configure 
privilege show level 5 command running-config 
privilege show level 5 command privilege 
privilege show level 5 command clock 
privilege show level 5 command ntp 
privilege show level 5 mode configure command logging 
privilege show level 5 command fragment 
terminal width 80 
Cryptochecksum:024e8e0639b2943b3587000beda8e7ed 
: end 
[OK] 
 

</div>

<div>
questions: 
&nbsp; 
&nbsp; 1) what are the internal and dmz IP addresses? 
&nbsp; 2) are you going to do passive or active ftp? 
&nbsp; 3) if passive ftp, what is the port range you will allow?
</div>

<div>
The dmz address is 10.71.42.165 
 
I need it to access 10.6.1.59 
 
What do you mean passive or active? I'm trying to set up this machine to automatically ftp from x.59. Is that passive?
</div>

<div>
With active ftp, the client initiates a connection to port 21 (the control channel) and transfer data to port 20 (the data channel) on the server. 
 
With passive ftp, the initiates a connection to port 21 and, upon authentication, initiates the connection from a high port on its machine to a high port on the server machine. 
 
With passive ftp, the server typically has a predefined range of allowed ports. 
 
When configuring rules, you have to know which ports or ranges of ports at the destination are needed.
</div>

<div>
What do you mean reapply the access-group command?
</div>

<div>
config t 
&nbsp;access-group dmz in interface dmz 
 
-------------- 
 
you're just typing it in again. &nbsp;if i recall with the pix, if i made an acl change, i had to reapply the access-list to the interface.
</div>

<div>
I added access-list, route, and reapplied. 
 
It's not working.
</div>

<div>
I added: 
 
static (inside,dmz) 10.6.1.0 10.6.1.0 255.255.255.0 0 0 
 
It's working, but it's not restricting to ftp. I can also telnet.
</div>

<div>
Can you post the entire dmz access list and the relevant log lines that show a successful telnet? 
 
You may have to explicity block it (it should be listed before the &quot;permit ip any any&quot;) 
 
&nbsp; -&gt; access-list dmz deny ip any host 10.6.1.59
</div>

<div>
I made a mistake, it's working like it should. 
 
Thanks!
</div>

<div>
<div class="content wysiwyg-content">
I've got a PIX 515e running a dmz. I have a new server I want to add to the dmz and allow it to connect to a specific machine on the internal interface. 
I need to allow: 
Only this machine to access only this internal machine 
Only allow ftp to and from these 2 machines 
 
Can someone take a look at my config and help me put in correct entries?
</div>
</div>

I've got a PIX 515e running a dmz. I have a new server I want to add to the dmz and allow it to connect to a specific machine on the internal interface.
I need to allow:
Only this machine to access only this internal machine
Only allow ftp to and from these 2 machines

Can someone take a look at my config and help me put in correct entries?

Need to allow access to 1 internal IP from 1 IP in my DMZ

Cisco PIX is a dedicated hardware firewall appliance; the Cisco Adaptive Security Appliance (ASA) is a firewall and anti-malware security appliance that provides unified threat management and protection the PIX does not. Other Cisco devices and systems include routers, switches, storage networking, wireless and the software and hardware for PIX Firewall Manager (PFM), PIX Device Manager (PDM) and Adaptive Security Device Manager (ASDM).