Access from dmz to inside (dumb question)

(10.99.7.66/34942) to inside:10.99.15.20/22 (10.99.7.67/22)

255.255.255.255 0 0

Well,

ssh access from dmz to inside should work fine, if you use a host in dmz that has an other IP than 10.99.7.66. If your only goal is ssh access from dmz 10.99.7.66 to inside 10.99.15.20 then the first static line is a problem because is makes the access impossible.

That said I must warn you that doing NAT between local networks (which inside and dmz usually are) adds an extra level of complexity. You could do without NAT like this

access-list 100 permit tcp 10.99.15.0 255.255.255.0 any eq ssh access-list 100 permit udp 10.99.0.0 255.255.240.0 any access-list 100 permit tcp 10.99.0.0 255.255.240.0 any access-list 101 permit tcp 10.99.7.64 255.255.255.224 host 10.99.15.20 eq ssh access-list inside_nonat permit ip 10.99.15.0 255.255.255.0 10.99.7.64

255.255.255.224 ip address outside 10.99.127.249 255.255.255.224 ip address inside 10.99.15.251 255.255.255.0 ip address dmz 10.99.7.65 255.255.255.224 global (dmz) 1 interface nat (inside) 0 access-list inside_nonat nat (inside) 1 10.99.15.0 255.255.255.0 0 0 access-group 100 in interface inside access-group 101 in interface dmz

Thanks! I used your example, access between dmz and inside work fine. But, I cant understand how static translation work. I use following config: : Saved : Written by enable_15 at 10:03:57.581 UTC Fri Jun 10 2005 PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security4 enable password xxxxxxx encrypted passwd xxxxxxx encrypted hostname pix domain-name xxxxx.ru fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list acl_dmz permit tcp host 10.99.7.66 host 10.99.9.1 eq smtp access-list acl_dmz permit udp host 10.99.7.66 host 10.99.9.1 eq domain

access-list acl_out permit tcp any host 10.99.127.252 eq smtp access-list acl_out permit tcp any host 10.99.127.252 eq pop3 access-list acl_in permit tcp 10.99.0.0 255.255.240.0 host 10.99.7.66 eq ssh access-list acl_in permit tcp 10.99.0.0 255.255.240.0 host 10.99.7.66 eq smtp access-list acl_in permit tcp 10.99.0.0 255.255.240.0 host 10.99.7.66 eq domain access-list acl_in permit udp host 10.99.9.1 eq domain 10.99.7.64

255.255.255.224 access-list acl_in permit tcp 10.99.0.0 255.255.240.0 host 10.99.7.66 eq telnet access-list inside_nonat permit ip 10.99.0.0 255.255.240.0 10.99.7.64 255.255.255.224 pager lines 24 logging on logging monitor debugging mtu outside 1500 mtu inside 1500 mtu dmz 1500 ip address outside 10.99.127.253 255.255.255.248 ip address inside 10.99.15.251 255.255.255.0 ip address dmz 10.99.7.65 255.255.255.224 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 access-list inside_nonat static (inside,dmz) 10.99.15.0 10.99.15.0 netmask 255.255.255.0 0 0 static (inside,dmz) 10.99.9.0 10.99.9.0 netmask 255.255.255.0 0 0 static (inside,dmz) 10.99.0.0 10.99.0.0 netmask 255.255.255.0 0 0 static (dmz,outside) 10.99.127.252 10.99.7.66 netmask 255.255.255.255 0 0 access-group acl_out in interface outside access-group acl_in in interface inside access-group acl_dmz in interface dmz route inside 0.0.0.0 0.0.0.0 10.99.15.253 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute ....

When client try to c10.99.7.66 10.99.127.254 SYN-RCVD

I really cant understand logic of PIX...