Cisco PIX

There's an implicit "deny ip any any" at the end of an access list so the permits in your list are the only traffic that's now allowed. What you probably want to do is add a line denying all other traffic from caffe to ksieg then permitting any other traffic, like this:

access-list caffe_to_ksieg permit tcp 192.168.3.0 255.255.255.0 host

Sam

Sam Wilson pisze:

Thank you! Now it works fine and i understand what happend. I have one more question. Cisco PIX default permit access from higer security to lower security interface. But i need to use global to use that, right? But if i use global on lower security than i have full IP access from higer to lower, so full access to all hosts on lower security interface. Is there any way to gain access from higer security to only one specific host on lower security and only to SQL Server (1433tcp 1434udp).

Adam

Not necessarily - depends on whether you're actually translating addresses or not - I think we'd have to see more of your configuration to be able to help.

Yep, access lists again, applied either inbound on the higher security interface or outbound on the lower security one.

Sam