PIX 515E Config for DMZ with WebServer 1

[RMurr34]

Hello people-smarter-than-me,

I have a PIX515E that's already configured and fuly functional for corporate use. I recently added a DMZ with a webserver that I want outside access to. For the life of me I cannot get access to it from the Internet. Here are the commands I've run to get where I am:

interface ethernet2 auto
nameif ethernet2 DMZ security60
object-group service webservices tcp
port-object eq www
port-object eq ftp
port-object eq https
access-list dmz_outside permit tcp any host 69.90.xxx.xxx eq www
access-list dmz_inside permit tcp any host 192.168.120.4 eq www
mtu DMZ 1500
ip address DMZ 192.168.120.1 255.255.255.0
static (DMZ,outside) 69.90.xxx.xxx 192.168.120.4 netmask 255.255.255.255 0 0
access-group dmz_outside in interface DMZ

I'm new to the PIX stuff so any help would be GREATLY appreaciated.

Thanks for your time

 

[Supergrrover]

I would need to see the whole config but that looks like it should have worked.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[andrewis]

It looks like you assigned the ACL to the DMZ interface instead of the outside interface.

access-list dmz_outside permit tcp any host 69.90.xxx.xxx eq www

That ACL should be added to the outside interface and not the DMZ.

 

[RMurr34]

Thanks for the replies. Here's my entire config:

: Saved
: Written by enable_15 at 00:05:01.634 UTC Fri Jan 1 1993
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 DMZ security60
enable password rXHlGvMv8WFrA/L5 encrypted
passwd U.xfZODdY4e7i8OE encrypted
hostname xxxxxx
domain-name xxxxxxxxxxxxxxx.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service webservices tcp
port-object eq www
port-object eq ftp
port-object eq https
access-list 101 permit ip 192.168.12.0 255.255.255.0 10.100.10.0 255.255.255.0
access-list 101 permit ip any 10.100.10.0 255.255.255.0
access-list 102 permit tcp any host 69.90.xxx.xxx eq 3389
access-list 102 permit tcp any host 69.90.xxx.xxx eq 3389
access-list outside_cryptomap_dyn_30 permit ip any 10.100.10.0 255.255.255.0
access-list outside_cryptomap_dyn_50 permit ip any 10.100.10.0 255.255.255.0
access-list split permit ip 192.168.12.0 255.255.255.0 10.100.10.0 255.255.255.0
access-list dmz_outside permit tcp any host 69.90.xxx.xxx eq www
access-list dmz_inside permit tcp any host 192.168.xxx.xxx eq www
pager lines 24
logging trap informational
logging facility 22
logging host inside 192.168.12.3
icmp permit any outside
icmp permit 192.168.120.0 255.255.255.0 outside
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
ip address outside 69.90.xxx.xxx 255.255.255.240
ip address inside 192.168.12.1 255.255.255.0
ip address DMZ 192.168.120.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool mypool 10.100.10.1-10.100.10.254
pdm location 192.168.1.0 255.255.255.0 inside
pdm location 192.168.12.3 255.255.255.255 inside
pdm location 192.168.12.4 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 69.90.xxx.xxx 192.168.12.4 netmask 255.255.255.255 0 0
static (inside,outside) 69.90.xxx.xxx 192.168.12.6 netmask 255.255.255.255 0 0
static (DMZ,outside) 69.90.xxx.xxx 192.168.120.4 netmask 255.255.255.255 0 0
access-group dmz_outside in interface DMZ
route outside 0.0.0.0 0.0.0.0 69.90.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server radius protocol radius
aaa-server radius max-failed-attempts 3
aaa-server radius deadtime 10
aaa-server radius (inside) host 192.168.12.3 xxxxxxxxxxxxx timeout 10
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.12.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community mindyerbeeswax
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 50 set transform-set myset
crypto map mymap 65535 ipsec-isakmp dynamic dynmap
crypto map mymap client authentication radius
crypto map mymap interface outside
isakmp enable outside
isakmp client configuration address-pool local mypool outside
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup seaflow address-pool mypool
vpngroup seaflow dns-server 192.168.12.3
vpngroup seaflow wins-server 192.168.12.3
vpngroup seaflow default-domain xxxxxxxxxxxxxxx.com
vpngroup seaflow split-tunnel split
vpngroup seaflow idle-time 1800
vpngroup seaflow password ********
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 192.168.12.0 255.255.255.0 inside
ssh timeout 60
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn enable outside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:d128897ba03734d4ede87d6ba71a786a

 

[Supergrrover]

good catch - andrewis is right. switch the acl from the dmz interface to the outside interface and that should fix it.

coffee is no substitute for sleep.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[RMurr34]

Thanks guys. What should be access-group be?

access-group outside in interface dmz?

 

[Supergrrover]

Do this

no access-group dmz_outside in interface DMZ
access-group dmz_outside in interface outside

that should do the trick.


Brent
Systems Engineer / Consultant
CCNP, CCSP