Going from higher security level interface to lower security interface- HELP!!! -

What Have I to do for doing this?

I have 5 interface
inside 100
DMZ_I 20
DMZ_E 10
Tunn_ 5
outside 0

Host A behind DMZ_I must establish a connection to host B behind the DMZ_E
A must present itself with its own IP adderess.
Which command does this?

I know it is quite stupid but I'm trying to do this via PIX Web interface and I cannot accomplish this result.

Thank you for your support,


Alex.

 

Another thing that can help me in troubleshoot tha problem above could be this.
I saw syslog messages of the PIX.
It tells me which access list drop the packets. Is there a way to know which rule acts the dropping action?

For example, has the following message

Dec 22 09:22:13 --firewall--.--mycompany--.com %PIX-4-106023: Deny icmp src DMZ_I:192.168.28.1 dst DMZ_E:10.132.0.16
(type 8, code 0) by access-group "DMZ_I_access_in"

a particular meaning? Or it simply tells me the packet was dropped by that access list?

Thank you
Alex.

 

:What Have I to do for doing this?

:I have 5 interface
:inside 100
MZ_I 20
MZ_E 10
:Tunn_ 5
utside 0

:Host A behind DMZ_I must establish a connection to host B behind the DMZ_E
:A must present itself with its own IP adderess.
:Which command does this?

Forgive me, but I'm tired of answering pretty much the same question
every few days, so I'll just point you to an extensive answer I
wrote up a few days ago:

http://groups.google.ca/groups?selm=cpt9d2$5bm$

 

:Another thing that can help me in troubleshoot tha problem above could be this.
:I saw syslog messages of the PIX.
:It tells me which access list drop the packets. Is there a way to know which rule acts the dropping action?

Not directly. If, though, you show access-list DMZ_I_access_in
then you will see 'hit' counts at the end of each line. Those counts
are incremented each time there is a match.


:For example, has the following message

ec 22 09:22:13 --firewall--.--mycompany--.com %PIX-4-106023: Deny icmp src DMZ_I:192.168.28.1 dst DMZ_E:10.132.0.16 (type 8, code 0) by access-group "DMZ_I_access_in"

:a particular meaning? Or it simply tells me the packet was dropped by that access list?

It tells you that an ICMP Echo (aka ping) packet was not
permitted to go from interface DMZ_I, IP address 192.168.28.1,
to interface DMZ_E, IP address 10.132.0.16, and that the denial
was due to some rule in DMZ_I_access_in .

It also implicitly tells you that 192.168.28.1 *would* be able to go to
10.132.0.16 if it were allowed to by the ACL. You know that because
if the PIX did not know how to get packets from 192.168.28.1
to 10.132.0.16 then the PIX would have instead generated a message
about "No translation group". Translations are checked before ACLs.

It does not, though, tell you what IP address that 192.168.28.1
would be presented as to 10.132.0.16. For that, you need
to turn your logging level up to at least 6, and see the
PIX-6-305011 message. I do not recall at the moment, though,
whether 305011 is generated before ACLs are checked.

 

I thank you publicly for your patience and support

Alex.