DMZ Access from LAN2

[br0ck]

I’m having a problem moving traffic into the DMZ from the remote LAN 2
LAN1 is fine.
I need users to be able to browse pages on the web server in the DMZ and I cant seem to get it working!?

192.168.200.x to 192.168.10.x

if i run a tracert from the remote host it is resolving to the 192.168.10.101 address but I cant seem to get the ACL’s correct to allow traffic


can anyone shed some light on this

thanks

[img]http://www.miamiitsupport.com/post/ttpost.jpg[/img]

PIX 515

access-list nonat permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list nonat permit ip 192.168.200.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 192.168.10.0 255.255.255.0 192.168.200.0 255.255.255.0

access-list dmz_in permit tcp any host 192.168.100.31 eq 3389
access-list dmz_in permit tcp any host 192.168.100.31 eq citrix-ica
access-list dmz_in permit tcp any host 192.168.100.25 eq https
access-list dmz_in permit tcp host 192.168.10.100 host 192.168.100.25 eq smtp
access-list dmz_in deny ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0

access-list dmz_in permit ip any any

access-list NCVPN_list permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list NCVPN_list permit ip 192.168.10.0 255.255.255.0 192.168.200.0 255.255.255.0

PIX 501

access-list NCVPN_list permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list NCVPN_list permit ip 192.168.200.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list split permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list nonat permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list nonat permit ip 192.168.200.0 255.255.255.0 192.168.10.0 255.255.255.0

 

[horus42]

If the web server's gateway is not the firewall (515) you need to make sure that you add a static route which points to the firewall (515)


Hope that helps

 

[Supergrrover]

You need to add remote LAN to DMZ as interesting traffic - Try this (I have it up and running so I know it works with 7.1(x) and 7.2.1)

http://www.cisco.com/en/US/products...s_configuration_example09186a00806a5cea.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP