You need 2 things: ACL allowing access to your DMZ interface and a NAT rule.
What you need should be similar to this.
NAT Rule:
static (inside,dmz) 10.2.150.0 10.2.150.0 netmask 255.255.255.0
ACL:
access-list DMZ permit tcp 10.2.150.0 255.255.255.0 10.2.150.0 255.255.255.0 eq
22
access-group DMZ in interface dmz
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of anton schiller
Sent: Thursday, June 14, 2007 4:35 PM
To: firewalls@securityfocus.com
Subject: Pix 515 , ping to DMZ works ! ssh doesnt
Hi,
i have Cisco pix 515,
with some cong. like:
interface Ethernet0
nameif outside
security-level 0
ip address xx.xx.xx.6 255.255.255.240
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.2.150.1 255.255.255.0
!
interface Ethernet2
nameif dmz
security-level 50
ip address 10.2.151.1 255.255.255.0
access-list outside-acl extended permit icmp any any
access-list outside-acl extended permit gre any any
access-list outside-acl extended permit tcp any eq pptp any
access-list outside-acl extended permit tcp any any eq pptp
access-list outside-acl extended permit tcp any host xx.xx.xx.6 eq ssh
access-list outside-acl extended permit tcp any host xx.xx.xx.6 eq www
access-list outside-acl extended permit tcp any host xx.xx.xx.6 eq ftp
global (outside) 1 xx.xx.x.7
global (dmz) 1 interface
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.8 1
*****************************************************************
connection to outside is working
ping to a machine in the DMZ is working
ssh to that machine in the DMZ machine is not working, and i would like to
know where to start working on it
thanks for your help
regards
________________________________
Windows Live Messenger - Schreiben. Sehen. Hören. Wie im echten Leben. Windows
Live Messenger!
<http://imagine-msn.com/messenger/launch80/default.aspx?locale=de-at&source=joinmsncom/messenger>
