PIX routing or access-list problem?


with my Pix I had the following setup:

outside --- Pix --- inside

Now I added a separate LAN for external PCs. I added this Lan to interface ethernet 2. Now things look like this:

outside --- Pix --- inside | +----- guests

Guests have adresses 192.168.20.x, inside computers 10.1.y.x . Guests are able to connect to outside using NAT & PAT. But I can't get the connection between guests and inside to work. The relevant config of the Pix:

interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto

nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 guests security50 access-list guest-in permit ip any any access-list guest-in permit icmp any any

ip address outside ip address inside ip address guests

global (outside) 1 global (outside) 2 nat (inside) 1 0 0 nat (guests) 2 0 0

static (inside,guests) netmask 0 0

access-group guest-in in interface guests

route outside 1

The Pix is able to ping to guests, inside is not able to reach guests. What I am missing?

Regards, Christoph Gartmann

Reply to
Christoph Gartmann
Loading thread data ...
********* You may try

static (inside,guests) netmask 0 0

instead of

static (inside,guests) netmask 0 0

************* The command "static (int1,int2 ) fake_ip real_ip" translates the real_ip of int1 for the fake_ip on int2

but since is not a real_ip of your interface inside "static (inside,guests) netmask 0 0" doesn't accomplish anything

but static (inside,guests) netmask 0 0 will make your inside network accessible to your guests network. You can then filter your access from guests to inside with your access-list guest-in and your access from inside to guest with an access-list inside-in

Reply to

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.