From DMZ to a internal server

[nilsf]

I want to connect a WEB server on the DMZ to a internal server over the port 20001.
I've tried several configurations without success. You are my last hope!!
The web server on the DMZ has this IPnumber: 192.168.0.6
The internal server has 10.137.0.7. The port I want the web server to connect to the internal server is 20001
I've tried this config, but it doesn't work:

static (inside,dmz) 192.168.0.10 10.137.0.7
conduit permit tcp host 192.168.0.10 eq 20001 any

I can't ping or telnet the server on the intern side from the web server on the DMZ, but it works fine if I connect to it from another PC on the intern side.

Here is my PIX config:




PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50



fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
no names
access-list nonat permit ip 10.0.0.0 255.255.255.0 10.1.0.0 255.255.255.0
pager lines 24
logging on
logging buffered alerts
logging facility 6
interface ethernet0 10baset
interface ethernet1 10baset
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside xxx.xxx.xxx.210 255.255.255.248
ip address inside 10.137.0.1 255.255.248.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0

pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 192.168.0.10-192.168.0.254 netmask 255.255.255.0
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (dmz,outside) xxx.xxx.xxx.214 192.168.0.6 netmask 255.255.255.255 0 0
static (inside,dmz) 192.168.0.10 10.137.0.7 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit tcp host xxx.xxx.xxx.214 eq

http://www any

conduit permit tcp host 192.168.0.10 eq 20001 any

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server AuthInbound protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local vpn outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpn3000 idle-time 1800
ssh timeout 60

 

[Zelandakh]

What is the netmask of the web server and of the insternal server?

 

[yizhar]

HI.

What about syslog messages?
Try to work with "logging buffer 4" or 5 until you find the problem, then lower back the level as needed.

What is the default gateway of the internal server?

Your VPN configuration seems incomplete to me.
If so (VPN isn't working yet), then you should better disable it:
no crypto map mymap interface outside
no isakmp enable outside
If I'm wrong about this so you can ignore my last note.

Why are you working with conduit and not access-list?

Try to open a different port for the test like telnet/http/ftp etc to the same internal server. Does this work?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[gbiello]

Yizhar has some good points. I'd convert the conduits to access-lists, and start trouble-shooting with a syslog server.
-gbiello

 

[nilsf]

Hi guys,

I'm really appreciating your help, thanks!

- The internal server netmask is 255.255.255.248 and the Web server is 255.255.255.0

- I don't know how syslog works, can you tell me what I have to do?

- Here is the information i did't send before:

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp client configuration address-pool local vpn outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpn3000 address-pool vpn
vpngroup vpn3000 dns-server xxx.xxx.xxx
vpngroup vpn3000 wins-server xxx.xxx.xxx
vpngroup vpn3000 default-xxxxxxxxxxxx
vpngroup vpn3000 idle-time 1800
vpngroup vpn3000 password xxxxxxxxxxxxxxxxxxxxxxx
telnet 10.0.0.0 255.0.0.0 inside
telnet timeout 5
ssh xxx.xxx.xxx.xxx 255.255.255.0 outside
ssh xxx.xxx.xxx.xxx 255.255.255.248 outside
ssh timeout 60
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local vpn
vpdn group 1 client configuration dns xxx.xxx.xxx.xx
vpdn group 1 client authentication aaa AuthInboundn


- I'm working with conduit because all the others statics links are using conduit. (I didn't send the others conduit entries)

- It's not work even if I open for ALL TCP traffic from the DMZ to the Internal lan.

Thanks!

Nils

 

[yizhar]

HI.

What is the default gateway of the internal server?
This is important for your case.

- I don't know how syslog works, can you tell me what I have to do?
You already have syslog messages in the buffer, so type:
show log
in a telnet session to view them.
But you should better use higher logging level for the troubleshooting phase:
logging buffer 5

You'll find more info in the pix command reference, and a good syslog server for Windows here:

http://www.kiwi-enterprises.com

- It's not work even if I open for ALL TCP traffic from the DMZ to the Internal lan...
But have you installed any TCP service on that machine for the test? setup a simple telnet/ftp/

http://www server

on the machine and try to access it via the pix.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[nilsf]

Hi Yizhar,

The Web server gateway is 192.168.0.1, which is the ip address of the dmz interface (ip address dmz 192.168.0.1 255.255.255.0). Sorry I forgot this!

I can do every think a want from the web server to another server, ping, telenet,If I put the web server on the inside lan. But nothing works through the firewall.

Thanks

Nils

 

[nilsf]

Hi Guys,

I've found the error! This configuration works:
static (inside,dmz) 192.168.0.10 10.137.0.7
conduit permit tcp host 192.168.0.10 eq 20001 any

The problem was, that I tried, from the web server, to telnet the internal host by it's internal ip address 10.137.0.7 and not 192.168.0.10.

Sorry for this and THANK you for your help

Nils