Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > Newbie DMZ traffic troubles

Reply
Thread Tools

Newbie DMZ traffic troubles

 
 
knoall@gfs-or.com
Guest
Posts: n/a
 
      12-22-2005
Hello, I'm a PIX newbie and am fumbling around with some of my config.
I'm trying to get SQL queries from a machine on the internal interface
over a DMZ to a server at the other end of the DMZ.
>From the PIX terminal I am able to ping the SQL box, but I am not able

to get any traffic across from the machine on the internal interface.
I thought my config was pretty simple, but perhaps too simple since it
does not work....
Im wondering if i need a special ACL or a nat 0 statement or something
but i dont really know what i am supposed to do with those!
....
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 Gozer_DMZ security30
enable password
hostname
domain-name
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.10.2 isa
access-list 101 permit tcp any interface outside eq https
access-list 101 permit tcp any interface outside eq www
access-list Gozer_DMZ_Access permit icmp any host 172.18.15.10 echo
access-list Gozer_DMZ_Access permit tcp host 172.18.15.5 eq 1433 host
172.18.15.10
pager lines 24
mtu outside 1500
mtu inside 1500
mtu Gozer_DMZ 1500
ip address outside 10.10.10.1 255.255.255.0
ip address inside 192.168.10.1 255.255.255.0
ip address Gozer_DMZ 172.18.15.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.0 255.255.0.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
static (inside,outside) tcp interface https isa https netmask
255.255.255.255 0 0
static (inside,outside) tcp interface www isa www netmask
255.255.255.255 0 0
static (inside,Gozer_DMZ) 172.18.15.10 isa netmask 255.255.255.255 0 0
access-group 101 in interface outside
access-group Gozer_DMZ_Access in interface Gozer_DMZ
route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 192.168.10.254 /
floodguard enable
telnet timeout 5
ssh 192.168.0.0 255.255.0.0 inside
ssh timeout 30
console timeout 0
terminal width 80
banner exec ***** Authorized Use ONLY
: end
gzr00#

 
Reply With Quote
 
 
 
 
Todd
Guest
Posts: n/a
 
      12-26-2005
I would try reversing your static statement:

static(Gozer_DMZ,inside) isa 172.18.15.10 netmask 255.255.255.255

Assuming isa is an available IP on your inside network. It will be the
IP of your SQL server as far as the inside hosts are concerned...

The access-lists you have are not needed, because traffic from your
hosts will be comming from the inside interface which has higher
security, going to lower security DMZ interface. This traffic will be
allowed through. You only need to permit traffic generated from the SQL
server back to the queriers inside your network.

Tod

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Cisco 2811 dmz troubles kylej6 Hardware 0 04-15-2009 12:27 AM
help with pix inside->outside + dmz->outside + inside->outside->dmz Jack Cisco 0 09-19-2007 01:57 AM
Allow smtp traffic from DMZ to Inside, without DMZ loosing Internet connection? morten Cisco 4 09-04-2007 01:48 PM
Cisco PIX DMZ to DMZ Access Network-Guy Cisco 7 09-25-2005 08:28 PM
how to config 515-e-dmz dmz routes & ACL? JohnC Cisco 9 12-07-2004 09:14 AM



Advertisments