1st only internet/DMZ traffic should be routed into the PIX,
The Pix will not act as an internal router through one interface as a cisco
router will, ie it dose not do redirects.
The route statement should be on the inside interface not the wan
To nat to the DMZ use a NAT 0 (ie do not NAT)
NAT (inside) 0 access-list
Because this is a directly connected interface there is no need to a route.
HTH
Andy
-----Original Message-----
From: Hesperia DOS-IT Security [mailto:itsecurity@hoteles-hesperia.es]
Sent: 21 March 2005 09:39
To: Firewalls-SF
Subject: HELP ON ROUTING!!!
I have a PIX 515E and I have some routing problems. I configured these
zones:
nameif ethernet0 outside security0 (let´s me connect to internet)
nameif ethernet1 inside security100 (my local LAN)
nameif ethernet2 dmz security50 (servers acceessible from outside)
nameif ethernet4 wan security60 (remote LAN that connect to local lan and
also use the outside connection to connecto to internet)
Wan interface is connected to a router that connects to 48 lans (192.168.1.0
to 192.168.48.0). These users should be able to connect to inside users, and
also connect to internet by outside interface.
I configured this:
nat (inside) 1 192.168.244.0 255.255.255.0 0 0
global (outside) 1 IP_publica
route wan 192.168.254.0 255.255.255.0 192.168.240.2 1 (by doing this, I am
able to ping hosts on lan from de pix, but local lan users cannot ping them)
access-list outbound permit icmp any any
access-list outbound permit ip any any
access-list outbound permit tcp any any
access-group outbound in interface inside
access-group outbound in interface wan
(this access-list commands is to make sure nothing is blocking the traffic)
The question is? How could I do NAT so all my local lan users are able to
connect to all other lan(192.168.1.x-48.x and 192.168.254.x)? How can I make
all of them to connect to Internet through the same interface?
See jpg file to see the scenario diagram. Thanks a lot.
Eduardo Di Monte
--------------------------------------------------------------------------
FREE Download - The Future in Desktop Firewalls is Available Now
NEW NetOp Desktop Firewall, the world's first driver-centric
firewall software - protecting your laptops and corporate PCs at
ring-zero! NetOp features sophisticated process & application
control, centralized management and multiple network user profiles -
NetOp is able to increase security when mobile users plug back
into your network. Step into a more secure future - Try it FREE
http://www.securityfocus.com/sponsor/CrossTec_firewalls_050315
--------------------------------------------------------------------------
