Hi hellboy101,
I just want to let you know that I'm trying to make sure you understand what I'm doing. You know teach the man to fish...
I just happen to be geeky enough to really enjoy this kind of thing and I always want to know "why", not just "how".
So I applogize if I seems like I'm telling you what to do or talking down to you. That isn't my intention. At the bottom are the actual commands with no commentary.
"the correct one is the one you wrote in the previous email?
static (inside,dmz) 172.17.xx.54 172.16.xx.54 netmask 255.255.255.255 0 0
- this is the correct one? but I don't have a box with the IP
172.16.xx.54...
I DO have a box with the IP
172.16.xx.54 (this is my Norton server that resides in the LAN)
so should I change the static mapping to reflect this?"
Those address in bold are both the same. I'm going to assume the first one is supposed to be 172.17.xx.54--correct?
access-list acl_dmz permit tcp host sales_server host 172.17.xx.54 eq www
access-list acl_dmz permit tcp host sales_server host 172.17.xx.54 eq ftp
These access-list statements say take any port 80 and port 21 traffic that comes from the host sales_server and allow it in on IP address 172.17.xx.54--which lives on the PIX.
Then you send that traffic to the 172.16.xx.54--Norton--server with a static mapping. So you don't need a server with an IP of 172.17.xx.54.
That IP address exists soley for the purpose of sending traffic to the 172.16.xx.54 server and is created by the first access-list statement that uses it.
172.17.xx.54 is the address that any device on the DMZ that wants to communicate with the norton server must use.
Then the static mapping:
static (inside,dmz) 172.17.xx.54 172.16.xx.54 netmask 255.255.255.255 0 0
Says take the port traffic that is destined for the 172.17.xx.54 address and send it to the NortonServer (172.16.xx.54)
Don't enter these two since they are actually duplicate entries of the two above--they just use the IP instead of the name and I should have caught that.
access-list acl_dmz permit tcp host 172.17.xx.6 host 172.17.xx.54 eq www
access-list acl_dmz permit tcp host 172.17.xx.6 host 172.17.xx.54 eq ftp
Remove these. They aren't doing anything since the IP addresses in bold aren't on the DMZ. Or you can leave them if you want.
access-list acl_dmz permit ip host sales_server host
172.16.xx.54
access-list acl_dmz permit tcp host sales_server host
172.16.xx.54 eq www
access-list acl_dmz permit tcp host sales_server host
172.16.xx.54 eq ftp
access-list acl_dmz permit tcp host 172.16.79.6 host
172.16.xx.54 eq www
access-list acl_dmz permit tcp host 172.16.79.6 host
172.16.xx.54 eq ftp
static (inside,dmz) 172.16.X.54 sales_track netmask 255.255.255.255 0 0--Yes, remove this. It will conflict with the access-list statement above.
static (dmz,inside) 172.16.X.6 sales_track netmask 255.255.255.255 0 0--I can't see this doing anything. To work it would need to read:
static (inside,dmz) sales_track 172.16.X.6 netmask 255.255.255.255 0 0--but the sales_track is a computer not a representive IP address that lives on the PIX...
**If you are unsure, then leave it. It's not hurting anything.**
"So my static map is wrong then eh? The static map below..."
"static (inside,dmz) 172.16.X.54 sales_server netmask 255.255.255.255 0 0 - is incorrect?? ok."
Yes. For a few reasons.
1. A static mapping from the DMZ to inside needs to have the DMZ IP address first and the inside IP address 2nd.
sales_server 172.16.xx.54
2. You can't map a device to a device. You have to create an IP address that represents the internal device and map from it to the internal device.
*********************************
To paste it in the PIX, from the enable prompt, it would look like this:
config t
no access-list acl_dmz permit ip host sales_server host 172.16.xx.54
no access-list acl_dmz permit tcp host sales_server host 172.16.xx.54 eq www
no access-list acl_dmz permit tcp host sales_server host 172.16.xx.54 eq ftp
no access-list acl_dmz permit tcp host 172.16.79.6 host 172.16.xx.54 eq www
no access-list acl_dmz permit tcp host 172.16.79.6 host 172.16.xx.54 eq ftp
access-list acl_dmz permit tcp host sales_server host 172.17.xx.54 eq www
access-list acl_dmz permit tcp host sales_server host 172.17.xx.54 eq ftp
no static (inside,dmz) 172.16.X.54 sales_track netmask 255.255.255.255 0 0
static (inside,dmz) 172.17.xx.54 172.16.xx.54 netmask 255.255.255.255 0 0
Once that's done, test it and don't write to memory until you are happy with the results.
Also, the VLAN shouldn't affect anything.
*********************************
Sorry I'm so long winded. If it doesn't work after this, then there may need to be additional ports opened.
You can check to see if the access-list statements are being hit by using the
show access-list acl_dmz command and looking at the hit counters.
Please let me know.
Roland
What's ADD again?
