Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > Newbie DMZ traffic troubles

Thread Tools

Newbie DMZ traffic troubles
Posts: n/a
Hello, I'm a PIX newbie and am fumbling around with some of my config.
I'm trying to get SQL queries from a machine on the internal interface
over a DMZ to a server at the other end of the DMZ.
>From the PIX terminal I am able to ping the SQL box, but I am not able

to get any traffic across from the machine on the internal interface.
I thought my config was pretty simple, but perhaps too simple since it
does not work....
Im wondering if i need a special ACL or a nat 0 statement or something
but i dont really know what i am supposed to do with those!
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 Gozer_DMZ security30
enable password
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
name isa
access-list 101 permit tcp any interface outside eq https
access-list 101 permit tcp any interface outside eq www
access-list Gozer_DMZ_Access permit icmp any host echo
access-list Gozer_DMZ_Access permit tcp host eq 1433 host
pager lines 24
mtu outside 1500
mtu inside 1500
mtu Gozer_DMZ 1500
ip address outside
ip address inside
ip address Gozer_DMZ
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm logging informational 100
pdm history enable
arp timeout 14400
static (inside,outside) tcp interface https isa https netmask 0 0
static (inside,outside) tcp interface www isa www netmask 0 0
static (inside,Gozer_DMZ) isa netmask 0 0
access-group 101 in interface outside
access-group Gozer_DMZ_Access in interface Gozer_DMZ
route outside 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside /
floodguard enable
telnet timeout 5
ssh inside
ssh timeout 30
console timeout 0
terminal width 80
banner exec ***** Authorized Use ONLY
: end

Reply With Quote
Posts: n/a
I would try reversing your static statement:

static(Gozer_DMZ,inside) isa netmask

Assuming isa is an available IP on your inside network. It will be the
IP of your SQL server as far as the inside hosts are concerned...

The access-lists you have are not needed, because traffic from your
hosts will be comming from the inside interface which has higher
security, going to lower security DMZ interface. This traffic will be
allowed through. You only need to permit traffic generated from the SQL
server back to the queriers inside your network.


Reply With Quote

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Cisco 2811 dmz troubles kylej6 Hardware 0 04-15-2009 12:27 AM
help with pix inside->outside + dmz->outside + inside->outside->dmz Jack Cisco 0 09-19-2007 01:57 AM
Allow smtp traffic from DMZ to Inside, without DMZ loosing Internet connection? morten Cisco 4 09-04-2007 01:48 PM
Cisco PIX DMZ to DMZ Access Network-Guy Cisco 7 09-25-2005 08:28 PM
how to config 515-e-dmz dmz routes & ACL? JohnC Cisco 9 12-07-2004 09:14 AM