config dmz address to inside and access from outside

[mikroman]

I have an inside address that needs to be a dmz address accessable from the outside. can this be done if so how? here is my config. I need 208.136.201.250 to map to 192.168.192.13 accessable from outside.

Building configuration...
: Saved
:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd OloSL2oV3ZQTHoTU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside-access-dmz permit tcp any host 208.136.201.51 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.52 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.53 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.54 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.55 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.56 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.57 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.250 eq www
access-list outside-access-dmz permit tcp any host 208.136.201.41 eq smtp
access-list dmz-access-inside permit tcp any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 208.136.200.2 255.255.255.0
ip address inside 192.168.192.3 255.255.255.0
ip address dmz 208.136.201.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
pdm history enable
arp timeout 14400
global (outside) 1 208.136.200.3
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,dmz) 192.168.192.0 192.168.192.0 netmask 255.255.255.0 0 0
static (dmz,outside) 208.136.201.0 208.136.201.0 netmask 255.255.255.0 0 0
access-group outside-access-dmz in interface outside
access-group dmz-access-inside in interface dmz
route outside 0.0.0.0 0.0.0.0 208.136.200.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.192.88 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:666771a80eaef276d8bfd2353992f188
: end
[OK]


any help would be great.

 

[tbissett]

Unfortunately, this won't work because the static command must reference the outside interface, which would conflict with your static referencing the DMZ.

What you could do is map the 192.168.x.x address to an outside IP and permit traffic to it. Security-wise, there is no difference since the host is physically on the inside anyway, so it doesn't matter if you map it to the DMZ or the outside.

The following example would map the IP to 208.136.200.250 and permit http access from the outside:
static (inside,outside) 208.136.200.250 192.168.192.13
access-list outside-access-dmz permit tcp host 208.136.200.250 eq www

DISCLAIMER: While this will work, the better idea is to physcially install any externally accessible hosts on the DMZ segment instead of the inside segment. The whole idea behind having a DMZ is so that no one from the outside accesses anything directly in the inside of your network.

 

[yizhar]

HI.

Instead of static, you can simply use "nat 0" if you want to use public addresses in DMZ:
nat (dmz) 0 0 0

> access-list dmz-access-inside permit tcp any any
> static (inside,dmz) 192.168.192.0 192.168.192.0 netmask 255.255.255.0 0 0
What do you need this for?
The DMZ has almost full access to all inside hosts.
You should redefine your network security policy, evaluate threats, and reconfigure the pix to allow only the minimal required traffic.



Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar