I have a websever set up on a DMZ and a database server that is set up on another subnet. I need to allow access to the database from the webserver but not open the port to the internet. Lets say the webserver is 192.168.222.222 and the database server is 192.168.1.8. I need to open port 3053 from the webserver to the database sever. Im using an NSA2600 with updated firmware. Any help would be greatly appreciated. Ive dealt with the NSA series a lot but have never had to open ports to other subnets on it. TIA
Try this example from Cisco Support (assuming your device is Cisco)
class-map type inspect match-all all-private match access-group 101 ! policy-map type inspect priv-pub-pmap class type inspect all-private inspect class class-default ! zone security private zone security public zone-pair security priv-pub source private destination public service-policy type inspect priv-pub-pmap ! interface FastEthernet4 ip address 172.16.108.44 255.255.255.0 zone-member security public ! interface Vlan1 ip address 192.168.108.1 255.255.255.0 zone-member security private ! access-list 101 permit ip 192.168.108.0 0.0.0.255 any
Just modify it to your needs
Jesse, the task should not be very difficult. Your issue may be the order of operation. Firewall rules are prioritized and the order of statements is significant. Also, statements are applied in one direction so you will need to account for egress as well as ingress packets. Hope that helps.