Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Will this work?

Status
Not open for further replies.
cissp2002

cissp2002

MIS
Nov 15, 2001
15
US
PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security10
nameif ethernet3 intf3 security15
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname sglnapix
domain-name sgxxxxx.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol http 8002
names
access-list acl-outside permit tcp any host 66.16x.xx.148 eq domain
access-list acl-outside permit udp any host 66.16x.xx.148 eq dnsix
access-list acl-outside permit tcp any host 66.16x.xx.147 eq smtp
access-list acl-outside permit esp any host 66.16x.xx.150
access-list acl-outside permit udp any host 66.16x.xx.150 eq isakmp
access-list acl-outside permit udp any host 66.16x.xx.150 eq 10000
access-list acl-outside permit tcp host 20x.1xx.64.8 any eq 8889
access-list acl-outside permit tcp host 20x.2xx.137.57 host 166.82.113.54 eq 9080
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 1214
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 7011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 5395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 7042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 7023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 7021
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 15395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 17011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 17042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 17023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.83 eq 1525
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 1214
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 7011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 5395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 7042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 7023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 7021
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 15395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 17011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 17042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 17023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.117 eq 1525
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 1214
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 7011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 5395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 7042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 7023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 7021
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 15395
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 17011
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 17042
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 17023
access-list acl-outside permit tcp host 192.xx.161.2 host 166.82.113.53 eq 1525
access-list acl-outside deny icmp any any
access-list acl-outside deny ip any any
access-list acl-inside permit ip host 166.82.113.161 any
access-list acl-inside permit udp host 66.16x.xx.148 host 166.82.113.6 eq dnsix
access-list acl-inside permit tcp host 66.16x.xx.148 host 166.82.113.6 eq domain
access-list acl-inside permit udp host 66.16x.xx.148 host 166.82.113.4 eq dnsix
access-list acl-inside permit tcp host 66.16x.xx.148 host 166.82.113.4 eq domain
access-list acl-inside permit tcp host 10.128.33.55 host 172.16.1.254 eq telnet
access-list acl-inside permit tcp host 10.128.33.69 host 172.16.1.254 eq telnet
access-list acl-inside permit tcp host 10.128.33.69 host 172.16.1.254 eq 22
access-list acl-inside permit tcp host 10.128.33.55 host 172.16.1.254 eq 22
access-list acl-inside permit ip host 10.128.33.55 any
access-list acl-inside permit ip host 10.128.33.69 any
access-list acl-inside permit ip host 166.82.113.53 any
access-list acl-inside permit ip host 166.82.113.117 any
access-list acl-inside permit ip host 166.82.113.83 any
access-list acl-inside permit tcp host 166.82.113.14 any eq smtp
access-list acl-inside deny icmp any any
access-list acl-inside deny ip any any
access-group acl-outside in interface outside
access-group acl-inside in interface inside
pager lines 24
logging on
logging timestamp
logging standby
logging monitor debugging
logging buffered debugging
logging trap debugging
logging history debugging
logging facility 7
interface ethernet0 10baset
interface ethernet1 10baset
interface ethernet2 10baset
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
icmp deny any echo outside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 66.16x.xx.146 255.255.255.240
ip address inside 10.128.11.2 255.255.255.0
ip address dmz 10.128.12.1 255.255.255.0
ip address intf3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
failover ip address intf3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (dmz,outside) 66.16x.xx.147 10.128.12.2 netmask 255.255.255.255 0 0
static (dmz,outside) 66.16x.xx.150 10.128.12.5 netmask 255.255.255.255 0 0
static (dmz,outside) 66.16x.xx.148 10.128.12.3 netmask 255.255.255.255 0 0
static (dmz,outside) 66.16x.xx.149 10.128.12.4 netmask 255.255.255.255 0 0
static (inside,dmz) 10.128.33.0 10.128.33.0 netmask 255.255.255.0 0 0
static (inside,dmz) 166.82.0.0 166.82.0.0 netmask 255.255.0.0 0 0
route outside 0.0.0.0 0.0.0.0 66.16x.xx.145 1
route inside 10.0.0.0 255.0.0.0 10.128.11.1 1
route inside 166.82.0.0 255.255.0.0 10.128.11.1 1
route dmz 10.128.12.0 255.255.255.0 10.128.11.1 1
timeout xlate 0:01:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
service resetinbound
telnet timeout 5
ssh 10.128.11.11 255.255.255.255 inside
ssh 10.128.11.11 255.255.255.255 dmz
ssh timeout 5
terminal width 80
Cryptochecksum:621937b6a58b179849089a7a950fd350
: end


*The 166.82.113.0 network is used internally (done prior to me being hired)*

 
Sort by date Sort by votes
HI.

Some comments:

*
access-list acl-outside deny icmp any any
Blocking all ICMP traffic might cause some problems with network applications/protocols that use it.

*
logging monitor debugging
logging buffered debugging
logging trap debugging
logging history debugging

This is ofcourse not recommended for production unit.

*
interface ethernet0 10baset
interface ethernet1 10baset
interface ethernet2 10baset

I prefer using "auto" to allow full duplex when possible.

*
static (inside,dmz) 10.128.33.0 10.128.33.0 netmask 255.255.255.0 0 0
static (inside,dmz) 166.82.0.0 166.82.0.0 netmask 255.255.0.0 0 0

I'm not sure about this, but maybe better use "nat 0 access-list" instead of static to your whole inside networks, and use only specific "static" commands to internal servers that need to be accessed from the DMZ .


Bye


Yizhar Hurwitz
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

GeorgeAlba
  • Locked
  • Question
What do you think about this proxy
Replies
0
Views
98
GeorgeAlba
GeorgeAlba
steve56k
  • Locked
  • Question
VPN Tunnel will not start
Replies
0
Views
58
steve56k
steve56k
Garbear
  • Locked
  • Question
TZ190 VPN Connection works but can't ping some IP's on either side
Replies
0
Views
65
Garbear
Garbear
Spork52
  • Locked
  • Question
Is this secure? Serving content from two servers with SSL
Replies
3
Views
90
ChrisHirst
ChrisHirst
disturbedone
  • Locked
  • Question
proxy.pac not working correctly in IE11
Replies
0
Views
83
disturbedone
disturbedone

Part and Inventory Search

Sponsor

Back
Top