ALLOW ACCESS TO INTERNAL DEVICE BEHIND PIX

2) Do run NAT on the PIX ?

vreyesii wrote:

You need to have the access server on a different internal network, logically connected to a different PIX interface.

If you have a PIX 501, you will not be able to do this without adding another firewall.

If you have a PIX 506 or 506E then you can do it provided that your software is at least 6.3(3) and provided that your switch supports

If you have an older (pre 500-series) PIX, or a PIX 510 or 520, then you will need to use an additional physical interface on the PIX.

If you have a PIX 515 or 515E or 525 or 535, and 6.3(1) or later, you could proceed by way of VLANs. If you have those models but older software, then you will need to use an additional physical interface on the PIX.

That is what I thought also. I need a Firewall that has an another DMZ for this to work correct?

Thanks,

vreyesii

Walter Robers> >

Yes, your firewall needs a DMZ to do what you want to do. That DMZ can be a physical interface, or on a PIX 506, 506E, 515, 515E, 525 or 535 with appropriate software levels, it can be a "logical interface" (which is an 802.1Q VLAN -- which requires that your connected switch supports 802.1Q VLANs to take advantage of this possibility.)

Alright then thank you for your help.

vreyesii

Walter Robers> > >That is what I thought also. I need a Firewall that has an another DMZ

If u have a public nat outside,u can map the local server to a free local Ip like: ip nat inside source static 10.0.10.3 89.197.71.244

vreyesii wrote:

The device in question is a PIX, which does not use that syntax.

Also, the solution you propose is not sufficient to prevent the access-server from being used to talk to any of the other devices.