I have a websever set up on a DMZ and a database server that is set up on another subnet. I need to allow access to the database from the webserver but not open the port to the internet. Lets say the webserver is 192.168.222.222 and the database server is 192.168.1.8. I need to open port 3053 from the webserver to the database sever. Im using an NSA2600 with updated firmware. Any help would be greatly appreciated. Ive dealt with the NSA series a lot but have never had to open ports to other subnets on it. TIA

  • Do the servers reach each other now? Seems that you are working with different zones in a firewall. If so, you will need to create an extended ACL, that allows only TCP/UDP desired port and apply it to the interzone configuration – Antonio Perez Oseguera Dec 20 '16 at 15:35
  • No they do not currently communicate, but you are correct.The Database Server is on X0 and the Web Server is on X3 – Jesse R Dec 20 '16 at 16:22
  • I tried to create the ACL between the 2 ports with no luck. I know its something simple I am missing just unsure what. – Jesse R Dec 20 '16 at 16:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 17:03

Try this example from Cisco Support (assuming your device is Cisco)

class-map type inspect match-all all-private 
   match access-group 101
! 
policy-map type inspect priv-pub-pmap 
   class type inspect all-private 
     inspect
   class class-default 
! 
zone security private 
zone security public 
zone-pair security priv-pub source private destination public 
  service-policy type inspect priv-pub-pmap 
! 
interface FastEthernet4 
  ip address 172.16.108.44 255.255.255.0 
  zone-member security public 
! 
interface Vlan1 
  ip address 192.168.108.1 255.255.255.0 
  zone-member security private
! 
access-list 101 permit ip 192.168.108.0 0.0.0.255 any

Just modify it to your needs

  • 1
    If you would have bothered to read the question or done a quick google search you would see that his device runs SonicOS 6.2, not Cisco's IOS. – SuperAdmin Mar 22 '17 at 4:41

Jesse, the task should not be very difficult. Your issue may be the order of operation. Firewall rules are prioritized and the order of statements is significant. Also, statements are applied in one direction so you will need to account for egress as well as ingress packets. Hope that helps.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.