I've been setting up my first Pix for 2 weeks, now, and the more I look at this configuration script, the more it looks right! (But it's not)Set up: inside, outside, and dmz. Allow internet access to the 2 servers (gisserver 192.168.0.3 and server2 192.168.0.24) in the dmz; gisserver has to talk to a database server(10.10.2.2) inside on port 3306. Gisserver has to allow online payments, so security is an issue. Inside users must be able to access the dmz servers on their outside address. Allow VPN access from inside this site to a remote site, and vice versa. (As you'll see, I haven't even started on that yet!)
Problems: gisserver cannot talk to 10.10.2.2. No ping, no telnet, no nothing. I cannot ping inside from the dmz at all. 10.10.2.2 can ping and telnet the gisserver and server2. Both dmz servers can be accessed from outside, but not from inside on their public I.P's. They can be accessed from inside on their private I.P.s.
If I put in this static, I lose telnet from 10.10.2.2 to the gisserver...
static (inside,dmz) gisserver 10.10.2.2 netmask 255.255.255.255 0 0
Having all my questions answered would be great, but if nothing else, can you help with the port 3306 communication?
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password cMdDMJ3V4e7ljwK/ encrypted
passwd O53TYzRjGxGspzRe encrypted
hostname pix
domain-name pix3.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 2900
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol http 2900
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sqlnet 3306
fixup protocol tftp 69
names
name 192.168.0.3 gisserver
name 192.168.0.24 server2
access-list acl_out permit tcp any host 209.28.152.235 eq www
access-list acl_out permit tcp any host 209.28.152.236 eq www
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 209.28.152.235 eq https
access-list acl_out permit tcp any any eq domain
access-list acl_dmz permit tcp any host gisserver eq https
access-list acl_dmz permit tcp any host server2 eq https
access-list acl_dmz permit tcp any host server2 eq www
access-list acl_dmz permit tcp any host gisserver eq www
access-list acl_dmz permit tcp any host gisserver eq 3306
access-list acl_dmz permit icmp any any
access-list acl_dmz permit tcp any any eq domain
access-list acl_dmz permit tcp host gisserver host 10.10.2.2 eq 3306
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.28.152.234 255.255.255.248
ip address inside 10.10.2.1 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (dmz,outside) 209.28.152.235 gisserver netmask 255.255.255.255 0 0
static (dmz,outside) 209.28.152.236 server2 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 209.28.152.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 60
dhcpd address 10.10.2.10-10.10.2.199 inside
dhcpd address 192.168.0.50-192.168.0.199 dmz
dhcpd dns 142.177.1.2 142.177.129.11
dhcpd lease 344000
dhcpd ping_timeout 750
dhcpd domain pix3
dhcpd enable inside
terminal width 510
Cryptochecksum:06e1c2850421300980f29f9b0823bd9d
: end
Problems: gisserver cannot talk to 10.10.2.2. No ping, no telnet, no nothing. I cannot ping inside from the dmz at all. 10.10.2.2 can ping and telnet the gisserver and server2. Both dmz servers can be accessed from outside, but not from inside on their public I.P's. They can be accessed from inside on their private I.P.s.
If I put in this static, I lose telnet from 10.10.2.2 to the gisserver...
static (inside,dmz) gisserver 10.10.2.2 netmask 255.255.255.255 0 0
Having all my questions answered would be great, but if nothing else, can you help with the port 3306 communication?
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password cMdDMJ3V4e7ljwK/ encrypted
passwd O53TYzRjGxGspzRe encrypted
hostname pix
domain-name pix3.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 2900
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol http 2900
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sqlnet 3306
fixup protocol tftp 69
names
name 192.168.0.3 gisserver
name 192.168.0.24 server2
access-list acl_out permit tcp any host 209.28.152.235 eq www
access-list acl_out permit tcp any host 209.28.152.236 eq www
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 209.28.152.235 eq https
access-list acl_out permit tcp any any eq domain
access-list acl_dmz permit tcp any host gisserver eq https
access-list acl_dmz permit tcp any host server2 eq https
access-list acl_dmz permit tcp any host server2 eq www
access-list acl_dmz permit tcp any host gisserver eq www
access-list acl_dmz permit tcp any host gisserver eq 3306
access-list acl_dmz permit icmp any any
access-list acl_dmz permit tcp any any eq domain
access-list acl_dmz permit tcp host gisserver host 10.10.2.2 eq 3306
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.28.152.234 255.255.255.248
ip address inside 10.10.2.1 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (dmz,outside) 209.28.152.235 gisserver netmask 255.255.255.255 0 0
static (dmz,outside) 209.28.152.236 server2 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 209.28.152.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 60
dhcpd address 10.10.2.10-10.10.2.199 inside
dhcpd address 192.168.0.50-192.168.0.199 dmz
dhcpd dns 142.177.1.2 142.177.129.11
dhcpd lease 344000
dhcpd ping_timeout 750
dhcpd domain pix3
dhcpd enable inside
terminal width 510
Cryptochecksum:06e1c2850421300980f29f9b0823bd9d
: end
