- Posts: 783
- Thank you received: 0
Problem with DMZ nat?
- skepticals
- Topic Author
- Offline
- Elite Member
Less
More
17 years 4 months ago #22568
by skepticals
Problem with DMZ nat? was created by skepticals
I am trying to allow SMTP traffic from a host in my DMZ to a host on the Inside interface. I used the packet trace and it appears the ACL is correct, but the NAT isn't?
Interfaces:
[code:1]!
interface Ethernet0/0
description WAN Interface
nameif outside
security-level 0
ip address 198.x.x.x 255.255.255.240
!
interface Ethernet0/1
description DMZ Interface
nameif DMZ
security-level 50
ip address 172.16.0.1 255.255.255.0
!
interface Ethernet0/2
description Lan Interface
nameif inside
security-level 100
ip address 10.3.254.1 255.255.255.0
![/code:1]
Access lists:[code:1]access-list Static extended permit icmp any any echo-reply
access-list Static extended permit icmp any any unreachable
access-list CPL_splitTunnelAcl standard permit 10.3.254.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.3.254.0 255.255.255.0 10.3.254.0 255.255.255.192
access-list inside_nat0_outbound extended permit ip 10.3.4.0 255.255.255.0 10.3.254.0 255.255.255.192
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.3.4.0 255.255.255.0
access-list DMZ_to_Inside extended permit tcp host 172.16.0.5 host 10.3.4.50 eq smtp [/code:1]
Global NAT:[code:1]global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.3.0.0 255.255.0.0[/code:1]
Static commands:[code:1]static (inside,outside) 198.x.x.x 10.3.5.5 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.5.4 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.5.6 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.6.10 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.4.10 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.4.13 netmask 255.255.255.255
static (DMZ,outside) 198.x.x.x 172.16.0.3 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.3.7 netmask 255.255.255.255
static (DMZ,outside) 198.x.x.61 172.16.0.5 netmask 255.255.255.255
static (inside,DMZ) 10.3.3.0 10.3.3.0 netmask 255.255.255.0 [/code:1]
Access groups: [code:1]access-group Static in interface outside
access-group DMZ_to_Inside in interface DMZ[/code:1]
I need to allow DMZ host: 172.16.0.5 to send SMTP to Inside host 10.3.4.50.
What is this doing?
Thanks.
Interfaces:
[code:1]!
interface Ethernet0/0
description WAN Interface
nameif outside
security-level 0
ip address 198.x.x.x 255.255.255.240
!
interface Ethernet0/1
description DMZ Interface
nameif DMZ
security-level 50
ip address 172.16.0.1 255.255.255.0
!
interface Ethernet0/2
description Lan Interface
nameif inside
security-level 100
ip address 10.3.254.1 255.255.255.0
![/code:1]
Access lists:[code:1]access-list Static extended permit icmp any any echo-reply
access-list Static extended permit icmp any any unreachable
access-list CPL_splitTunnelAcl standard permit 10.3.254.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.3.254.0 255.255.255.0 10.3.254.0 255.255.255.192
access-list inside_nat0_outbound extended permit ip 10.3.4.0 255.255.255.0 10.3.254.0 255.255.255.192
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.3.4.0 255.255.255.0
access-list DMZ_to_Inside extended permit tcp host 172.16.0.5 host 10.3.4.50 eq smtp [/code:1]
Global NAT:[code:1]global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.3.0.0 255.255.0.0[/code:1]
Static commands:[code:1]static (inside,outside) 198.x.x.x 10.3.5.5 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.5.4 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.5.6 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.6.10 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.4.10 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.4.13 netmask 255.255.255.255
static (DMZ,outside) 198.x.x.x 172.16.0.3 netmask 255.255.255.255
static (inside,outside) 198.x.x.x 10.3.3.7 netmask 255.255.255.255
static (DMZ,outside) 198.x.x.61 172.16.0.5 netmask 255.255.255.255
static (inside,DMZ) 10.3.3.0 10.3.3.0 netmask 255.255.255.0 [/code:1]
Access groups: [code:1]access-group Static in interface outside
access-group DMZ_to_Inside in interface DMZ[/code:1]
I need to allow DMZ host: 172.16.0.5 to send SMTP to Inside host 10.3.4.50.
What is this doing?
access-list inside_nat0_outbound and nat (inside) 0 access-list inside_nat0_outbound
Thanks.
17 years 4 months ago #22578
by ramasamy
Replied by ramasamy on topic Re: Problem with DMZ nat?
Hi,
The NAT is there only for the traffic which is going to outside network and not to the DMZ network from Inside LAN.
Give the below mentioned commands and check.
global (DMZ) 1 interface
nat (inside) 1 10.3.0.0 255.255.0.0
The NAT is there only for the traffic which is going to outside network and not to the DMZ network from Inside LAN.
Give the below mentioned commands and check.
global (DMZ) 1 interface
nat (inside) 1 10.3.0.0 255.255.0.0
- skepticals
- Topic Author
- Offline
- Elite Member
Less
More
- Posts: 783
- Thank you received: 0
17 years 4 months ago #22582
by skepticals
Replied by skepticals on topic Re: Problem with DMZ nat?
Thank you for the reply.
Should I have to use:
[code:1]
global (DMZ) 2 interface
nat (inside) 2 10.3.0.0 255.255.0.0
[/code:1]
Instead of: [code:1]
global (DMZ) 1 interface
nat (inside) 1 10.3.0.0 255.255.0.0
[/code:1]
I already have a set numbered 1 for traffic outside of the outside interface. Do those numbers have to be unique to each set?
Also, I have a static command that allows traffic from the inside network to the DMZ. Do I need the global command also?
[code:1]
static (inside,DMZ) 10.3.3.0 10.3.3.0 netmask 255.255.255.0
[/code:1]
I thought this code was translating the 10.3.3.0 network to 10.3.3.0 on the DMZ. Is this incorrect?
Should I have to use:
[code:1]
global (DMZ) 2 interface
nat (inside) 2 10.3.0.0 255.255.0.0
[/code:1]
Instead of: [code:1]
global (DMZ) 1 interface
nat (inside) 1 10.3.0.0 255.255.0.0
[/code:1]
I already have a set numbered 1 for traffic outside of the outside interface. Do those numbers have to be unique to each set?
Also, I have a static command that allows traffic from the inside network to the DMZ. Do I need the global command also?
[code:1]
static (inside,DMZ) 10.3.3.0 10.3.3.0 netmask 255.255.255.0
[/code:1]
I thought this code was translating the 10.3.3.0 network to 10.3.3.0 on the DMZ. Is this incorrect?
- skepticals
- Topic Author
- Offline
- Elite Member
Less
More
- Posts: 783
- Thank you received: 0
17 years 4 months ago #22585
by skepticals
Replied by skepticals on topic Re: Problem with DMZ nat?
After researching more and testing other configs it came to me that I only have a static command for the 10.3.3.0 subnet and not the subnet that my servers are in. I added a new static translation for that network and everything works. This is without the added global/nat command you asked me to use.
Time to create page: 0.120 seconds