dmz setup help please

[djjazzyjeff]

Hi all, I have a Pix 515UR that I am trying to setup a dmz on. I want to connect a wireless access point (Cisco 350) to the dmz to allow access out to the internet only. I intend to put a dhcp server on the dmz to dole out addresses to wireless clients. My problem is this; wireless clients need name resolution services and I can't point them to external dns servers such as my T1 connected isp, AT&T. It doesn't work, I guess their dns servers are locked down to accept resolution requests only from my router's external interface IP address. As an alternative, I'd like to poke through the Pix to point dmz connected clients to my internal dns servers but allow no other connectivity to internal hosts. Can anyone help out here? Thx in advance......Jeff

 

[dankwizard]

Assuming:

ip address dmz 192.168.1.0 255.255.255.0
ip address inside 192.168.0.0 255.255.255.0

I would try this:

access-list dmz_in permit udp 192.168.1.0 255.255.255.0 host 192.168.0.1
access-group dmz_in in interface dmz

Where 192.168.0.1 is your inside dns server.

The only problem with this is (from my experience) once you bind an access-list to an interface using the access-group command, what is permitted in the access-list will be the only traffic that passes through that interface.

If the above access-list doesn't work, you may need a static command.

 

[djjazzyjeff]

Thanks man, I'll mess around and try this out......Jeff

 

[yizhar]

HI.

For DMZ to INSIDE traffic, you'll need both STATIC and ACCESS-LIST. Something like this:

ip address inside 10.1.1.254 255.255.255.0
ip address dmz 10.2.2.254 255.255.255.0
static (inside,dmz) 10.2.2.5 10.1.1.5
access-list dmz_in permit udp any host 10.2.2.5 eq 53
access-list dmz_in deny ip any 10.0.0.0 255.0.0.0
access-list dmz_in permit ip any any
access-group dmz_in in interface dmz

However, it would be much better (for security, performance and simplicity) to setup an additional DNS server on the DMZ network.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar