4

simple question. I am trying to allow traffic from NetworkA to NetworkB through and old PIX firewall. The firewall has a leg into each NetworkA+B.

nameif ethernet1 inside security 100
nameif ethernet2 dmz security 20

ip address inside 192.168.1.1 255.255.255.0
ip address dmz 192.168.254.1 255.255.255.0

I want to allow an IP 192.168.254.50 to connect to 192.168.1.10 over port 14333. After researching, I was told that I need to make a static statement for each direction and use conduit command as well...Correct me if I am wrong..

static (dmz,inside) 192.168.1.0 192.168.254.0 netmask 255.255.255.0 0 0 
conduit permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433

I have only done Cisco Firewall rules via access-lists and access-groups. However I am limited to this method due to the version of our PIX.

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 20:16
3

I can't say for certain with 6.2 as I'm only familiar with 6.3+ but this is how you would usually do it.

access-list dmz-in permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433
access-group dmz-in in interface dmz

This will basically put an access-list on the DMZ interface and allow the traffic that you have mentioned.

Be aware that if you don't already have one applied that when you put an access-group on an interface it changes the traffic behaviours of existing traffic and you will need to add these to the same ACL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.