Cisco – Allow Network to Network traffic for specific port, Cisco PIX v6.2

ciscofirewall

simple question. I am trying to allow traffic from NetworkA to NetworkB through and old PIX firewall. The firewall has a leg into each NetworkA+B.

nameif ethernet1 inside security 100
nameif ethernet2 dmz security 20

ip address inside 192.168.1.1 255.255.255.0
ip address dmz 192.168.254.1 255.255.255.0

I want to allow an IP 192.168.254.50 to connect to 192.168.1.10 over port 14333. After researching, I was told that I need to make a static statement for each direction and use conduit command as well…Correct me if I am wrong..

static (dmz,inside) 192.168.1.0 192.168.254.0 netmask 255.255.255.0 0 0 
conduit permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433

I have only done Cisco Firewall rules via access-lists and access-groups. However I am limited to this method due to the version of our PIX.

Best Answer

I can't say for certain with 6.2 as I'm only familiar with 6.3+ but this is how you would usually do it.

access-list dmz-in permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433
access-group dmz-in in interface dmz

This will basically put an access-list on the DMZ interface and allow the traffic that you have mentioned.

Be aware that if you don't already have one applied that when you put an access-group on an interface it changes the traffic behaviours of existing traffic and you will need to add these to the same ACL.

Related Topic