allow traffic from dmz to inside 1

[geeksquad]

i have a pix 515 with 3 interfaces.
Im trying to allow traffic from a certain host from dmz to a certain host on the inside ( from 172.16.10.2 to 10.0.0.2)

I reckon there's something to do with nating that im missing.

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password *********** encrypted
passwd ********** encrypted
hostname pix
domain-name krik.intra
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 10 permit ip 10.0.0.0 255.255.255.0 172.16.30.0 255.255.255.0
access-list 90 permit ip host 172.16.10.2 host 10.0.0.2
pager lines 24
logging on
logging console debugging
logging buffered debugging
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 192.168.1.10 255.255.255.0
ip address inside 10.0.0.1 255.255.255.0
ip address dmz 172.16.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 10
nat (inside) 1 10.0.0.0 255.255.255.0 0 0
access-group 90 in interface dmz
route outside 172.16.30.0 255.255.255.0 192.168.1.30 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.0.0.2 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set vpn-trans esp-des
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address 10
crypto map mymap 10 set peer 192.168.1.30
crypto map mymap 10 set transform-set vpn-trans
crypto map mymap 10 set security-association lifetime seconds 3600 kilobytes 4608000
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 192.168.1.30 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:d9686fac75a093171cdbdff95a45f1c8
: end


Any help is appreciated
Cheers
Krik

 

[Supergrrover]

You just need a nat exemption

nat (dmz) 0 access-list 90


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[geeksquad]

Brent , so just to make it more clear.

global (outside) 1 interface !!use the ip address of outside interface as natglobal ip ??
nat (inside) 1 10.0.0.0 255.255.255.0 0 0 !! nat this network connected to inside interface ??
nat (dmz) 1 172.16.10.0 255.255.255.0 0 0 !! nat this network connected to dmz interface ??

Now to allow traffic from dmz (sec50) to inside (sec 100):

access-list 90 permit ip host 172.16.10.2 host 10.0.0.2
access-group 90 in interface dmz
nat (dmz) 0 access-list 90 !! exempt from nat any packet that matched access-list 90 ??

Is this correct ? Im trying to get the basics:
When a packet is intended for inside and matched access-list 90 dont nat and forward to 10.0.0.2 ( so it will have a source of 172.16.10.2 and a destination address of 10.0.0.2)
My question is when the box on the inside responds to dmz it will have a source of 10.0.0.2 (default gateway 10.0.0.1) and a destination of 172.16.10.2 .
Will this packet get nated to global address since there is no exemption from nat or just gets forwarded ?

i hope i made myself undestood .

Cheers
Krik

 

[Supergrrover]

Yes that should do it.

You should be able to communicate from the inside interface to DMZ without any access list or natting. Now to allow the reverse (originating from DMZ) you will need the above. The gateway is the ASA itself and since the ASA knows of the 172 network it will send the reply to the proper network.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[geeksquad]

i figured out what the problem was , its so embarrasing.

It worked with static (inside, dmz) 172.16.10.3 10.0.0.2 , an access-list and applied inbound on dmz interface.
The problem : I was trying lets say to RDp into 10.0.0.2 instead of 172.16.10.3 (which gets translated !!!! )
Anyway it works now.Thanks for your help Brent