troubleshooting Question

PIX 515e DMZ traffic In/Out

Avatar of maredzki
maredzki asked on
CiscoHardware FirewallsNetwork Architecture
13 Comments1 Solution406 ViewsLast Modified:
Here is my scenario:
I have a public IP address dedicated to static translation, traffic from internal to Internet works in PAT mode using a separate IP. I need to have traffic coming to the host in the DMZ and traffic originating in the DMZ bound for Internet host on a specific ports. I have the following rules:

static (dmz,outside) <externalIP> <DMZ_IP> netmask 255.255.255.255 0 0
access-group outside_in_acl in interface outside
access-group dmz_int in interface dmz
access-list outside_in_acl permit tcp any host <externalIP> eq 9000
access-list dmz_int permit tcp host <DMZ_IP> host <Internet_Host> eq 5000

So, traffic originating in the DMZ will be allowed to leave on port 5000 and traffic coming in to the DMZ from the Internet will be allowed on port 5000. Does that look correct?

Also, the below command allows any host on the Internet to be allowed...
access-list outside_in_acl permit tcp any host <externalIP> eq 9000
can it be restricted to hosts by doing:
access-list outside_in_acl permit tcp host <InternetIP> host <externalIP> eq 9000
(access-list outside_in_acl permit tcp host 333.444.555a.666 host 222.333.444.555 eq 9000
access-list outside_in_acl permit tcp host 333.444.555.667 host 222.333.444.555 eq 9000 and
access-list outside_in_acl permit tcp host 333.444.555.668 host 222.333.444.555 eq 9000)?

Thanks and if I can supply with any other info please let me know.
ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 1 Answer and 13 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 13 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros