The more I learn about Pix 515, the more I realize how little I know...3 Problems; possible interconnected...
I'm trying to get gisserver (DMZ) to communicate with 10.10.2.2 (Inside) on port 3306. (Mysql) I can ping both ways between these servers. Telnet will connect from 10.10.2.2 to gisserver, but not on port 3306. Telnet will not connect from gisserver to 10.10.2.2 at all. (Says connection lost when I try port 3306).
Although I can ping from the DMZ to Outside, I cannot connect to a Web Site with a browser from the DMZ.
I need to be able to suck a ftp file out of databaseserver from Outside daily, and this isn't working either.
I'm posting a sanitized config, hope y'all can help. (Some of us Canadians say y'all; not all of us say eh)!
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password cMdDMJ3V4e7ljwK/ encrypted
passwd O53TYzRjGxGspzRe encrypted
hostname pix
domain-name nunatsiavut.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 2900
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol http 2900
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sqlnet 3306
fixup protocol tftp 69
names
name 192.168.0.3 gisserver
name 192.168.0.24 databaseserver
access-list acl_out permit tcp any host 209.28.152.235 eq www
access-list acl_out permit tcp any host 209.28.152.236 eq www
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 209.28.152.235 eq https
access-list acl_out permit tcp any host 209.28.152.236 eq ftp
access-list acl_out permit tcp any host 209.28.152.235 eq domain
access-list acl_out permit tcp any host 209.28.152.236 eq domain
access-list acl_out permit tcp any host 209.28.152.236 eq 3389
access-list acl_dmz permit icmp any any
access-list acl_dmz permit tcp host gisserver any eq https
access-list acl_dmz permit tcp host databaseserver any eq www
access-list acl_dmz permit tcp host gisserver any eq www
access-list acl_dmz permit tcp host gisserver any eq 3306
access-list acl_dmz permit tcp host gisserver any eq domain
access-list acl_dmz permit tcp host databaseserver any eq domain
access-list acl_dmz permit tcp host databaseserver any eq 3389
access-list acl_dmz permit tcp host databaseserver any eq ftp
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.28.152.234 255.255.255.248
ip address inside 10.10.2.1 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
static (dmz,outside) 209.28.152.235 gisserver netmask 255.255.255.255 0 0
static (dmz,outside) 209.28.152.236 databaseserver netmask 255.255.255.255 0 0
static (inside,dmz) 10.10.2.0 10.10.2.0 netmask 255.255.255.0 0 0
access-group acl_out in interface outside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 209.28.152.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 60
dhcpd address 10.10.2.10-10.10.2.199 inside
dhcpd address 192.168.0.50-192.168.0.199 dmz
dhcpd dns 142.177.1.2 142.177.129.11
dhcpd lease 344000
dhcpd ping_timeout 750
dhcpd domain nunatsiavut
dhcpd enable inside
terminal width 510
Cryptochecksum:e7be58366ecbe0e856224012ae926f4c
: end
[OK]
Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.
I'm trying to get gisserver (DMZ) to communicate with 10.10.2.2 (Inside) on port 3306. (Mysql) I can ping both ways between these servers. Telnet will connect from 10.10.2.2 to gisserver, but not on port 3306. Telnet will not connect from gisserver to 10.10.2.2 at all. (Says connection lost when I try port 3306).
Although I can ping from the DMZ to Outside, I cannot connect to a Web Site with a browser from the DMZ.
I need to be able to suck a ftp file out of databaseserver from Outside daily, and this isn't working either.
I'm posting a sanitized config, hope y'all can help. (Some of us Canadians say y'all; not all of us say eh)!
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password cMdDMJ3V4e7ljwK/ encrypted
passwd O53TYzRjGxGspzRe encrypted
hostname pix
domain-name nunatsiavut.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 2900
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol http 2900
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sqlnet 3306
fixup protocol tftp 69
names
name 192.168.0.3 gisserver
name 192.168.0.24 databaseserver
access-list acl_out permit tcp any host 209.28.152.235 eq www
access-list acl_out permit tcp any host 209.28.152.236 eq www
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 209.28.152.235 eq https
access-list acl_out permit tcp any host 209.28.152.236 eq ftp
access-list acl_out permit tcp any host 209.28.152.235 eq domain
access-list acl_out permit tcp any host 209.28.152.236 eq domain
access-list acl_out permit tcp any host 209.28.152.236 eq 3389
access-list acl_dmz permit icmp any any
access-list acl_dmz permit tcp host gisserver any eq https
access-list acl_dmz permit tcp host databaseserver any eq www
access-list acl_dmz permit tcp host gisserver any eq www
access-list acl_dmz permit tcp host gisserver any eq 3306
access-list acl_dmz permit tcp host gisserver any eq domain
access-list acl_dmz permit tcp host databaseserver any eq domain
access-list acl_dmz permit tcp host databaseserver any eq 3389
access-list acl_dmz permit tcp host databaseserver any eq ftp
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.28.152.234 255.255.255.248
ip address inside 10.10.2.1 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
static (dmz,outside) 209.28.152.235 gisserver netmask 255.255.255.255 0 0
static (dmz,outside) 209.28.152.236 databaseserver netmask 255.255.255.255 0 0
static (inside,dmz) 10.10.2.0 10.10.2.0 netmask 255.255.255.0 0 0
access-group acl_out in interface outside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 209.28.152.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 60
dhcpd address 10.10.2.10-10.10.2.199 inside
dhcpd address 192.168.0.50-192.168.0.199 dmz
dhcpd dns 142.177.1.2 142.177.129.11
dhcpd lease 344000
dhcpd ping_timeout 750
dhcpd domain nunatsiavut
dhcpd enable inside
terminal width 510
Cryptochecksum:e7be58366ecbe0e856224012ae926f4c
: end
[OK]
Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.
