PIX DMZ ping -> INSIDE

[Saroden]

Could I get a sample config from someone on how to ping from dmz to inside?

AND I DON'T MEAN "conduit permit icmp any any "!!!

Essentially I want to be able to connect to a NT domain by opening the following ports found in MS ARTICLE:

http://support.microsoft.com/default.aspx?scid=kb;en-us;q280132

 

[yizhar]

HI.

If you allow such access from the DMZ, then you compromise inside network security.

But if you insist, it can be done in similar way that you allow access to DMZ servers from outside:

b.b.b.b = internal ip address of internal server.

static (inside,dmz) a.a.a.a b.b.b.b
access-list fromdmz permit ??? .....
access-group fromdmz in interface dmz

You will also need an LMHOSTS file on the DMZ server.

If you need to access the whole inside network, you can use "nat 0 access-list" on the inside interface, but again, I do not recommend that you allow too much access from DMZ to inside.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar