Need to allow DMZ access to INSIDE from another firewall

[mknoxwfc]

Hi, we need to setup a control point on our DMZ to allow a third-party support group to manage a few of our servers from the DMZ. They are coming in from their own private link and will need to have full access to the secific systems.

I've tried several different setups and am failing.

Here is the current config.

:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list 101 permit ip 10.1.0.0 255.255.0.0 10.201.1.0 255.255.255.0
access-list 101 permit ip 172.16.0.0 255.255.0.0 10.201.1.0 255.255.255.0
access-list 102 permit tcp any host 133.144.155.10 eq ftp
access-list 102 permit tcp any host 133.144.155.26 eq smtp
access-list 102 permit tcp any host 133.144.155.26 eq www
access-list 102 permit tcp any host 133.144.155.11 eq ftp
access-list 103 permit ip host 133.144.155.12 host 191.147.116.29
access-list inside_access_in permit ip any any
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 133.144.155.20 255.255.255.240
ip address inside 10.1.1.253 255.255.0.0
ip address dmz 133.144.155.9 255.255.255.248
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 10.201.1.1-10.201.1.254
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
pdm location 10.1.2.10 255.255.255.255 inside
pdm location 10.1.2.50 255.255.255.255 inside
pdm location 10.1.2.80 255.255.255.255 inside
pdm location 10.1.2.81 255.255.255.255 inside
pdm location 10.1.2.85 255.255.255.255 inside
pdm location 10.1.2.0 255.255.255.0 inside
pdm location 10.1.5.1 255.255.255.255 inside
pdm location 10.1.5.0 255.255.255.0 inside
pdm location 10.1.100.0 255.255.255.0 inside
pdm location 10.2.0.0 255.255.0.0 inside
pdm location 172.16.0.0 255.255.0.0 inside
pdm location 133.144.155.10 255.255.255.255 dmz
pdm location 191.147.116.29 255.255.255.255 outside
pdm location 10.1.2.63 255.255.255.255 inside
pdm location 133.144.155.11 255.255.255.255 dmz
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 133.144.155.21
global (dmz) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 10.1.2.0 255.255.255.0 0 0
nat (inside) 1 10.1.5.0 255.255.255.0 0 0
nat (inside) 1 10.1.100.0 255.255.255.0 0 0
nat (inside) 1 10.2.0.0 255.255.0.0 0 0
nat (inside) 1 172.16.0.0 255.255.0.0 0 0
static (dmz,outside) 133.144.155.10 133.144.155.10 netmask 255.255.255.255 0 0
static (inside,outside) 133.144.155.26 10.1.2.50 netmask 255.255.255.255 0 0
static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.0.0 0 0
static (inside,dmz) 172.16.0.0 172.16.0.0 netmask 255.255.0.0 0 0
static (inside,outside) 133.144.155.11 10.1.2.85 netmask 255.255.255.255 0 0
static (inside,outside) 133.144.155.12 10.1.2.10 netmask 255.255.255.255 0 0
access-group 102 in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 133.144.155.19 1
route inside 172.16.0.0 255.255.0.0 10.1.1.254 1

Any info would help

Thanks,

Michael

 

[8624]

access-list acl_outside permit tcp ?.?.?.?. ?.?.?.? host server ip address of your server eq port

access-list group acl_outside in interface outside

try that
may have to alter it a bit should put you on the right track

 

[yizhar]

HI.

> route inside 172.16.0.0 255.255.0.0 10.1.1.254
Is this the private link of the 3rd party support?
Do they need access to inside+dmz, or only to dmz? Maybe placing the router in DMZ can simplify the design?

> static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.0.0
> static (inside,dmz) 172.16.0.0 172.16.0.0 netmask 255.255.0.0
What do you need the above lines for?

> nat (inside) 1 172.16.0.0 255.255.0.0
> global (dmz) 1 interface
> route inside 172.16.0.0 255.255.0.0 10.1.1.254 1
The above lines are enough to allow traffic from inside (including 3rd party subnet) to dmz.
So I guess that you have a routing problem which is not at the pix:
Check the 10.1.1.254 router configuration - does it have a route to 133.144.155.x ?
Check all routers and hosts along the path between 3rd party workstation (yes, the workstation!) and the dmz servers.

You can use the pix syslog messages (level 4 or 6) to verify if the pix is blocking anything or not.

Bye




Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar