«

Hello, I'm a PIX newbie and am fumbling around with some of my config.
I'm trying to get SQL queries from a machine on the internal interface
over a DMZ to a server at the other end of the DMZ.
>From the PIX terminal I am able to ping the SQL box, but I am not able
to get any traffic across from the machine on the internal interface.
I thought my config was pretty simple, but perhaps too simple since it
does not work....
Im wondering if i need a special ACL or a nat 0 statement or something
but i dont really know what i am supposed to do with those!
....
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 Gozer_DMZ security30
enable password
hostname
domain-name
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.10.2 isa
access-list 101 permit tcp any interface outside eq https
access-list 101 permit tcp any interface outside eq www
access-list Gozer_DMZ_Access permit icmp any host 172.18.15.10 echo
access-list Gozer_DMZ_Access permit tcp host 172.18.15.5 eq 1433 host
172.18.15.10
pager lines 24
mtu outside 1500
mtu inside 1500
mtu Gozer_DMZ 1500
ip address outside 10.10.10.1 255.255.255.0
ip address inside 192.168.10.1 255.255.255.0
ip address Gozer_DMZ 172.18.15.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.0 255.255.0.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
static (inside,outside) tcp interface https isa https netmask
255.255.255.255 0 0
static (inside,outside) tcp interface www isa www netmask
255.255.255.255 0 0
static (inside,Gozer_DMZ) 172.18.15.10 isa netmask 255.255.255.255 0 0
access-group 101 in interface outside
access-group Gozer_DMZ_Access in interface Gozer_DMZ
route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 192.168.10.254 /
floodguard enable
telnet timeout 5
ssh 192.168.0.0 255.255.0.0 inside
ssh timeout 30
console timeout 0
terminal width 80
banner exec ***** Authorized Use ONLY
: end
gzr00#

I would try reversing your static statement:

static(Gozer_DMZ,inside) isa 172.18.15.10 netmask 255.255.255.255

Assuming isa is an available IP on your inside network. It will be the
IP of your SQL server as far as the inside hosts are concerned...

The access-lists you have are not needed, because traffic from your
hosts will be comming from the inside interface which has higher
security, going to lower security DMZ interface. This traffic will be
allowed through. You only need to permit traffic generated from the SQL
server back to the queriers inside your network.

Tod