Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

PIX 515 DMZ-LAN communications

Status
Not open for further replies.
jgalley

jgalley

MIS
Mar 9, 2004
1
US
I am trying to configure a web server in my DMZ to communicate with an SQL server on the LAN, eventually some other protocols, but I think I can figure that out once I get SQL working. The DMZ web server is available to the internet, but trying to follow numerous config examples has led me nowhere. What am I missing in this config?

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security4
enable password ***** encrypted
passwd ********** encrypted
hostname pix01
domain-name xxx.org
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inbound permit icmp any any echo-reply
access-list inbound permit icmp any any unreachable
access-list inbound permit icmp any any time-exceeded
access-list inbound permit tcp any host a.b.76.195 eq pop3 log
access-list inbound permit tcp any host a.b.76.195 eq imap4 log
access-list inbound permit tcp any host a.b.76.195 eq smtp log
access-list dmzin permit icmp any any echo-reply
access-list dmzin permit icmp any any unreachable
access-list dmzin permit icmp any any time-exceeded
access-list dmzin permit tcp any host a.b.76.196 eq smtp log
access-list dmzin permit tcp any host a.b.76.196 eq access-list dmzin permit tcp any host a.b.76.197 eq access-list dmzin permit tcp any host a.b.76.198 eq access-list dmzin permit tcp any host a.b.76.200 eq access-list dmzin permit tcp any host a.b.76.201 eq access-list dmzin permit tcp any host a.b.76.203 eq access-list dmzin permit tcp any host a.b.76.204 eq access-list dmzin permit tcp any host a.b.76.205 eq ftp log
access-list dmzin permit tcp any host a.b.76.205 eq access-list dmzin permit tcp any host a.b.76.206 eq access-list dmzin permit tcp any host a.b.76.207 eq access-list dmzin permit tcp any host a.b.76.208 eq access-list dmzin permit tcp any host a.b.76.208 eq https log
access-list dmzin permit tcp any host a.b.76.208 eq ftp log
access-list dmzin permit tcp any host a.b.76.208 eq 26 log
access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168.5.96 255.255.255.224
access-list VPN_splitTunnelAcl permit ip 192.168.0.0 255.255.255.0 any
access-list outside_cryptomap_dyn_20 permit ip any 192.168.5.96 255.255.255.224
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside a.b.76.194 255.255.255.224
ip address inside 192.168.0.254 255.255.255.0
ip address dmz 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ipsecpool 192.168.5.100-192.168.5.120
ip local pool pptppool 192.168.0.230-192.168.0.239
pdm location 0.0.0.0 0.0.0.0 outside
pdm location a.b.76.199 255.255.255.255 outside
pdm location 192.168.0.89 255.255.255.255 inside
pdm location 192.168.0.250 255.255.255.255 inside
pdm location 192.168.1.8 255.255.255.255 dmz
pdm location 192.168.1.86 255.255.255.255 dmz
pdm location 192.168.1.87 255.255.255.255 dmz
pdm location 192.168.1.91 255.255.255.255 dmz
pdm location 192.168.1.92 255.255.255.255 dmz
pdm location 192.168.1.93 255.255.255.255 dmz
pdm location 192.168.1.94 255.255.255.255 dmz
pdm location 192.168.1.95 255.255.255.255 dmz
pdm location 192.168.1.96 255.255.255.255 dmz
pdm location 192.168.1.97 255.255.255.255 dmz
pdm location 192.168.1.98 255.255.255.255 dmz
pdm location 192.168.1.101 255.255.255.255 dmz
pdm location a.b.76.196 255.255.255.255 outside
pdm location a.b.76.197 255.255.255.255 outside
pdm location a.b.76.198 255.255.255.255 outside
pdm location a.b.76.200 255.255.255.255 outside
pdm location a.b.76.201 255.255.255.255 outside
pdm location a.b.76.203 255.255.255.255 outside
pdm location a.b.76.204 255.255.255.255 outside
pdm location a.b.76.205 255.255.255.255 outside
pdm location a.b.76.206 255.255.255.255 outside
pdm location a.b.76.207 255.255.255.255 outside
pdm location a.b.76.208 255.255.255.255 outside
pdm location 192.168.0.249 255.255.255.255 inside
pdm location 192.168.0.224 255.255.255.240 outside
pdm location 192.168.1.0 255.255.255.0 inside
pdm location 192.168.0.0 255.255.255.0 outside
pdm logging informational 512
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
static (inside,outside) tcp a.b.76.195 pop3 192.168.0.250 pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp a.b.76.195 imap4 192.168.0.250 imap4 netmask 255.255.255.255 0 0
static (inside,outside) tcp a.b.76.195 smtp 192.168.0.250 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp a.b.76.199 https 192.168.0.250 https netmask 255.255.255.255 0 0
static (inside,outside) tcp a.b.76.199 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.196 smtp 192.168.1.8 smtp netmask 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.196 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.197 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.198 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.200 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.201 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.203 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.204 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.205 ftp 192.168.1.93 ftp netmask 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.205 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.206 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.207 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.208 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.208 https 192.168.1.98 https netmask 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.208 26 192.168.1.98 smtp netmask 255.255.255.255 0 0
static (dmz,outside) tcp a.b.76.209 ftp 192.168.1.101 ftp netmask 255.255.255.255 0 0
access-group inbound in interface outside
access-group dmzin in interface dmz
route outside 0.0.0.0 0.0.0.0 a.b.76.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 192.168.0.249 XXXXXXX timeout 5
aaa-server LOCAL protocol local
aaa authentication telnet console RADIUS
aaa authentication http console RADIUS
ntp server 192.5.41.41 source outside prefer
http server enable
http 192.168.0.5 255.255.255.255 inside
snmp-server location
snmp-server contact
snmp-server community
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPN address-pool ipsecpool
vpngroup VPN dns-server 192.168.0.249 192.168.0.248
vpngroup VPN default-domain
vpngroup VPN split-tunnel VPN_splitTunnelAcl
vpngroup VPN idle-time 1800
vpngroup VPN password ********
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40
vpdn group PPTP-VPDN-GROUP client configuration address local pptppool
vpdn group PPTP-VPDN-GROUP client configuration dns 192.168.0.249 192.168.0.248
vpdn group PPTP-VPDN-GROUP client authentication aaa RADIUS
vpdn group PPTP-VPDN-GROUP client accounting RADIUS
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn enable outside
terminal width 80
 
Sort by date Sort by votes
Theres nothing on your dmzin access-list giving your web server permission to talk to the inside sql server..

You have the NAT 0 command right

but you still have to permit access through the ACL..


BuckWeet
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

sudhakar346
  • Locked
  • Question
Cisco ASA inside to DMZ issue over public IP
Replies
2
Views
96
kythri
kythri
xwray
  • Locked
  • Question
PIX 501 DHCP Server function
Replies
0
Views
61
xwray
xwray
brownmab53
  • Locked
  • Question
PIX 525 ASA not allowing DHCP addresses to pass through to router
Replies
0
Views
69
brownmab53
brownmab53
anoble1
  • Locked
  • Question
Need help setting up PIX 515 for home use along with DMZ PS4 configuration
Replies
0
Views
66
anoble1
anoble1
shmideo
  • Locked
  • Question
How to set up a wireless LAN on X5 interface TZ500
Replies
1
Views
81
shmideo
shmideo

Part and Inventory Search

Sponsor

Back
Top