i can't connect from dmz to inside network 1

[spillo3000]

i can't connect from dmz to inside network...
this is my pix configuration....



PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password 2KFQnbNIdI.2KYOU encrypted
passwd dsffwedededededWQDW encrypted
hostname pluto
domain-name pippo.it
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no names
access-list dmz-in permit icmp any any
access-list dmz-in permit tcp any any
access-list dmz-in permit udp any any
access-list dmz-in permit ip any any
pager lines 24
logging on
logging trap debugging
logging host dmz host-dmz
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside A.B.C.10 255.255.255.252
ip address inside A.B.D.1 255.255.255.0
ip address dmz A.B.E.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm history enable
arp timeout 14400
nat (inside) 0 A.B.C.0 255.255.255.0 0 0
nat (dmz) 0 A.B.E.0 255.255.255.0 0 0
access-group dmz-in in interface dmz
conduit permit icmp any any
conduit permit tcp A.B.D.0 255.255.255.0 range 0 65535 A.B.C.8 255.255.2
55.252
conduit permit udp A.B.D.0 255.255.255.0 range 0 65535 A.B.C.8 255.255.2
55.252
route outside 0.0.0.0 0.0.0.0 A.B.C.9 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 60
ssh timeout 5
terminal width 80
Cryptochecksum:WEDFFEVFEVRVREVRERGRERERGRVGR
fw-brazza#



why i can't connect from dmz hosts to inside hosts, and i can't ping .....


please help me..

 

[lgarner]

I don't see the NAT statement for dmz<->inside traffic. Try "static (inside,dmz) A.B.D.0 A.B.D.0 netmask 255.255.255.0

 

[spillo3000]

i must remove nat (dmz) 0 A.B.E.0 255.255.255.0 0 0
and add for try static (inside,dmz) A.B.D.0 A.B.D.0 netmask 255.255.255.0....

 

[lgarner]

No. They serve different functions, though "nat 0" might not be what you want there, either.

"nat 0" simply translates the source address of packets to their own address. It doesn't magically make the internal network visible to the outside or effectively turn the Pix into a router.

For example, "nat (inside) 0 0 0 0 0" says that all packets entering the inside interface will not be translated to anything different. Otherwise, the Pix operates normally. Replies to outbound connections will be answered.

However, unsolicited inbound traffic will be dropped because there's no *inbound* NAT rule in place. The static statement determines which addresses are "published" to the outside world. When you use "static (inside,outside) 1.2.3.0 1.2.3.0 netmask 255.255.255.0", you're creating a 1 to 1 mapping in both directions. This, coupled with an ACL, allows outside hosts to connect to inside hosts by their real addresses.