pix515e配置求助

hzleihuan

PIX515E，只要用静态的NAT，不要做global的PAT，要地址段为8和0的机器只能访问地址为192.168.9.2 WEB server和192.168.9.99的proxy server，我就写了以下配置，可当在8网段ping 192.168.8.1能通，却不能ping到192.168.8.2.有什么错误，请大家帮忙提示一下吧，有点急
nameif ethernet0 outside security0
nameif ethernet2 dmz security50
nameif ethernet1 inside security100
enable password 750401 encrypted
passwd 710401 encrypted

hostname fw-pix515e

fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol smtp 25

pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu dmz 1500
mtu inside 1500

ip address outside 192.168.0.201 255.255.255.0
ip address inside 192.168.9.95 255.255.255.128
ip address dmz 192.168.8.1 255.255.255.0

ip audit info action alarm
ip audit attack action alarm
no failover

failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address libdmz 0.0.0.0
failover ip address dmz 0.0.0.0
failover ip address inside 0.0.0.0
pdm history enable
arp timeout 14400

static (inside,dmz) 192.168.8.2 192.168.9.2 netmask 255.255.255.255 0 0
static (inside,dmz) 192.168.8.3 192.168.9.99 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.202 192.168.9.2 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.203 192.168.9.99 netmask 255.255.255.255 0 0

access-list acl_outside permit tcp any host 192.168.0.202 eq www
access-list acl_outside permit tcp any host 192.168.0.203 eq 8080
access-list acl_outside permit udp any host 192.168.0.203 eq 8080
access-list acl_outside permit icmp any any

access-list acl_dmz permit tcp any host 192.168.8.2 eq www
access-list acl_dmz permit tcp any host 192.168.8.3 eq 8080
access-list acl_dmz permit udp any host 192.168.8.3 eq 8080
access-list acl_dmz permit icmp any any

access-group acl_outside in interface outside
access-group acl_dmz in interface dmz

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.9.0 255.255.255.0 inside
telnet timeout 5
terminal width 80

[/quote][quote]