Newbie DMZ traffic troubles

Discussion in 'Cisco' started by, Dec 22, 2005.

  1. Guest

    Hello, I'm a PIX newbie and am fumbling around with some of my config.
    I'm trying to get SQL queries from a machine on the internal interface
    over a DMZ to a server at the other end of the DMZ.
    >From the PIX terminal I am able to ping the SQL box, but I am not able

    to get any traffic across from the machine on the internal interface.
    I thought my config was pretty simple, but perhaps too simple since it
    does not work....
    Im wondering if i need a special ACL or a nat 0 statement or something
    but i dont really know what i am supposed to do with those!
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 Gozer_DMZ security30
    enable password
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    name isa
    access-list 101 permit tcp any interface outside eq https
    access-list 101 permit tcp any interface outside eq www
    access-list Gozer_DMZ_Access permit icmp any host echo
    access-list Gozer_DMZ_Access permit tcp host eq 1433 host
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu Gozer_DMZ 1500
    ip address outside
    ip address inside
    ip address Gozer_DMZ
    ip audit info action alarm
    ip audit attack action alarm
    pdm location inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    static (inside,outside) tcp interface https isa https netmask 0 0
    static (inside,outside) tcp interface www isa www netmask 0 0
    static (inside,Gozer_DMZ) isa netmask 0 0
    access-group 101 in interface outside
    access-group Gozer_DMZ_Access in interface Gozer_DMZ
    route outside 0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    tftp-server inside /
    floodguard enable
    telnet timeout 5
    ssh inside
    ssh timeout 30
    console timeout 0
    terminal width 80
    banner exec ***** Authorized Use ONLY
    : end
    , Dec 22, 2005
    1. Advertisements

  2. Todd Guest

    I would try reversing your static statement:

    static(Gozer_DMZ,inside) isa netmask

    Assuming isa is an available IP on your inside network. It will be the
    IP of your SQL server as far as the inside hosts are concerned...

    The access-lists you have are not needed, because traffic from your
    hosts will be comming from the inside interface which has higher
    security, going to lower security DMZ interface. This traffic will be
    allowed through. You only need to permit traffic generated from the SQL
    server back to the queriers inside your network.

    Todd, Dec 26, 2005
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. JohnC
    Walter Roberson
    Dec 7, 2004
  2. Network-Guy

    Cisco PIX DMZ to DMZ Access

    Network-Guy, Sep 23, 2005, in forum: Cisco
    Walter Roberson
    Sep 25, 2005
  3. morten
    Tilman Schmidt
    Sep 4, 2007
  4. Jack
  5. kylej6

    Cisco 2811 dmz troubles

    kylej6, Apr 15, 2009, in forum: Hardware
    Apr 15, 2009