dmz access-list issue 2

[DV37201]

I've got a 525 with 3 interfaces and all works fine until I apply an access list (access-list dmz permit tcp host 10.10.20.10 host 192.168.1.39 eq smtp) to the dmz interface to allow a mail server to hit the inside. After I apply this access-list, dmz hosts can no longer access the outside. If I remove the list, dmz hosts can access the outside, but the dmz mail server can obviously no longer hit the inside. I apologize as I imagine this has been covered, but I couldn't find this situation in previous posts.

Thanks

 

[lgarner]

You need to allow access from the DMZ to the outside:
"access-list dmz permit ip any any" would open it back up fully. That could also allow more access to the inside, which might be mitigated by limiting the static nats (inside,dmz). You could also add acl entries to deny access, placing them before the permit:
"access-list dmz deny ip any 192.168.1.0 255.255.255.0"

Here's why this happens: Pix will, by default, allow all traffic from higher security levels (dmz) to lower ones (outside), and replies to established connections can come back in. Once an ACL is applied to an interface, all this goes out the window. The ACL takes over. Plus, all ACLS have an implicit "deny ip any any" at the end. So, with your single ACL entry to permit some traffic, you have blocked everything *but* that traffic. Hope this makes sense.

 

[DV37201]

Thanks for the answer and especially for the explanation. I assume I would place my permit line for the SMTP 1st, then the deny line you suggested, and finally the permit ip any any line? I am also assuming this will open up the DMZ to all traffic?

The reason this was confusing to me is that I have an extensive ACL applied to the outside interface, and it still allows all inside traffic to get out using the rule you mentioned about replying to established connections. Any info on why it is different with acls on the outside interface and acls on the dmz interface would be appreciated.

Thanks again

 

[lgarner]

Yes, make sure that your rules are in order. They're evaluated top-down, and the first one which applies to the packet received is the one that's used. If the ACL lines are in the order that you indicated, then yes- the DMZ could fully access the Internet. The deny statement would prevent it from accessing the inside.

On the Pix, ACL's are applied only to the inbound interface. An ACL on the outside interface won't affect outbound traffic, only incoming. When you had no ACL on the DMZ, it worked just like the inside i/f. When the ACL is applied to the source i/f, all traffic must be evaluated and pass that before it's allowed into the Pix for routing.

 

[DV37201]

Thanks, this makes sense now. Once again I appreciate the explanation as it is much more valuable than just an answer. I applied the suggested acl and everything works fine.

Thanks