Newbie DMZ traffic troubles

Discussion in 'Cisco' started by knoall@gfs-or.com, Dec 22, 2005.

  1. Guest

    Hello, I'm a PIX newbie and am fumbling around with some of my config.
    I'm trying to get SQL queries from a machine on the internal interface
    over a DMZ to a server at the other end of the DMZ.
    >From the PIX terminal I am able to ping the SQL box, but I am not able

    to get any traffic across from the machine on the internal interface.
    I thought my config was pretty simple, but perhaps too simple since it
    does not work....
    Im wondering if i need a special ACL or a nat 0 statement or something
    but i dont really know what i am supposed to do with those!
    ....
    :
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 Gozer_DMZ security30
    enable password
    hostname
    domain-name
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    name 192.168.10.2 isa
    access-list 101 permit tcp any interface outside eq https
    access-list 101 permit tcp any interface outside eq www
    access-list Gozer_DMZ_Access permit icmp any host 172.18.15.10 echo
    access-list Gozer_DMZ_Access permit tcp host 172.18.15.5 eq 1433 host
    172.18.15.10
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu Gozer_DMZ 1500
    ip address outside 10.10.10.1 255.255.255.0
    ip address inside 192.168.10.1 255.255.255.0
    ip address Gozer_DMZ 172.18.15.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm location 192.168.0.0 255.255.0.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    static (inside,outside) tcp interface https isa https netmask
    255.255.255.255 0 0
    static (inside,outside) tcp interface www isa www netmask
    255.255.255.255 0 0
    static (inside,Gozer_DMZ) 172.18.15.10 isa netmask 255.255.255.255 0 0
    access-group 101 in interface outside
    access-group Gozer_DMZ_Access in interface Gozer_DMZ
    route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
    1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    tftp-server inside 192.168.10.254 /
    floodguard enable
    telnet timeout 5
    ssh 192.168.0.0 255.255.0.0 inside
    ssh timeout 30
    console timeout 0
    terminal width 80
    banner exec ***** Authorized Use ONLY
    : end
    gzr00#
     
    , Dec 22, 2005
    #1
    1. Advertising

  2. Todd Guest

    I would try reversing your static statement:

    static(Gozer_DMZ,inside) isa 172.18.15.10 netmask 255.255.255.255

    Assuming isa is an available IP on your inside network. It will be the
    IP of your SQL server as far as the inside hosts are concerned...

    The access-lists you have are not needed, because traffic from your
    hosts will be comming from the inside interface which has higher
    security, going to lower security DMZ interface. This traffic will be
    allowed through. You only need to permit traffic generated from the SQL
    server back to the queriers inside your network.

    Tod
     
    Todd, Dec 26, 2005
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. JohnC
    Replies:
    9
    Views:
    903
    Walter Roberson
    Dec 7, 2004
  2. Network-Guy

    Cisco PIX DMZ to DMZ Access

    Network-Guy, Sep 23, 2005, in forum: Cisco
    Replies:
    7
    Views:
    3,952
    Walter Roberson
    Sep 25, 2005
  3. morten
    Replies:
    4
    Views:
    1,306
    Tilman Schmidt
    Sep 4, 2007
  4. Jack
    Replies:
    0
    Views:
    724
  5. kylej6

    Cisco 2811 dmz troubles

    kylej6, Apr 15, 2009, in forum: Hardware
    Replies:
    0
    Views:
    1,943
    kylej6
    Apr 15, 2009
Loading...

Share This Page