Similar question regarding "Accessing DMZ from Inside

[robharper]

I am having a silimar issue to g4...

Using a PIX 515 to provide the following services:

- Act as a firewall
- Site to site VPN with a 506 on the other end
- Remote VPN (7-10 concurrent connections)

Without making this ten pages long, we already have a T1 connection to the internet, via an older Cisco 1600. Our gateway is established via Novell and the PIX was added along with an ADSL 2.4 Mbps connection to service VPN requirements along with a small group of internal staff with higher bandwidth access to the web. In order to access the web via the PIX simply requires the workstation to point to a different gateway other than Novell and we are almost up and running.

Details
-------

Our internal IP range is a standard internal Class C
192.168.xxx.xxx
The second range we need to access is
142.142.xxx.xxx

I can access the web from inside
I have established VPN setup from outside

The piece that is missing is that I cannot access a seperate IP range from inside, while it is working fine if I VPN in.

Thus I connect to the web from home, connect to the PIX via Cisco VPN client, logon to our network and I can see the IP range 142.142.xxx.xxx.

From inside the network I connect to the PIX, can access the web but I am unable to see the IP range 142.142.xxx.xxx

I have been doing all the setup through PDM 6.2 and I did check to ensure that our internal DNS had a pointer for the host in particular I am trying to connect to and it did.

I am not really sure what else to try.

Should I add the PIX to DNS??

Any assistance would be greatly appreciated

 

[yizhar]

HI.

This could be a routing issue.
Do you have something like this:
thread35-149781

Try to use "route add" on the internal host - does it help?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[robharper]

I already have the 142.142.xxx.xxx setup on the PIX, in fact it was needed in order to gain access to this range via VPN access.

It is just anyone inside the firewall that points to the PIX for internet access is unable to access the 142.142.xxx.xxx range.

 

[yizhar]

HI.

Try to use "route add" on the internal host - does it help?

The pix will not send ICMP redirect to internal hosts, so they need to know the route to 142.142.xxx.xxx by other means, like using "route add ..." commands.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[haknwak]

I went through the identical process - read my explanation of solution at

http://honor.trusecure.com/pipermail/firewall-wizards/2002-December/013770.html

My situation is a little different because I have a router as inside default gateway but the concept should be very similar - espcially the way I made the static mapping

static (inside,DMZ) my.inside.net.0 255.255.255.0 my.inside.net.0 255.255.255.0

you read it correctly - i just NATted my inside address space to the DMZ interface and vois lais - connectivity.