Velocity Reviews - Computer Hardware Reviews
Home Forums Reviews Guides Newsgroups Register Search
Member Login:

Velocity Reviews > Newsgroups > Computing > Cisco > PIX-515 static problem

Reply
Thread Tools

PIX-515 static problem

 
 
Ben Bosshardt
Guest
Posts: n/a
 
      06-17-2004
After some hints out of this newsgroup, I reconfigured my firewall and
came up with the settings below. For some reason it is still
impossible to reach my webserver from outside on 80.XXX.XXX.2 which is
static on 192.168.20.5. Can anyone spot the mistake I made right away?

Thanks for your help
Ben



PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXXX encrypted
hostname PIX
domain-name any.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 80.XXX.XXX.2 webaddress
name 192.168.20.5 web_mail_server
name 80.XXX.XXX.5 voip_public
access-list outside_access_in permit tcp any host voip_public eq 5060
access-list outside_access_in permit tcp any host voip_public range
10000 20000
access-list outside_access_in permit tcp any host webaddress eq www
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 80.XXX.XXX.6 255.255.255.248
ip address inside 192.168.10.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.10.30 255.255.255.255 inside
pdm location 192.168.10.5 255.255.255.255 inside
pdm location 192.168.10.96 255.255.255.224 outside
pdm location 192.168.10.15 255.255.255.255 inside
pdm location 192.168.10.105 255.255.255.255 inside
pdm location 192.168.10.14 255.255.255.255 inside
pdm location webaddress 255.255.255.255 outside
pdm location 192.168.10.20 255.255.255.255 inside
pdm location 192.168.10.0 255.255.255.0 inside
pdm location web_mail_server 255.255.255.255 inside
pdm location 192.168.20.20 255.255.255.255 inside
pdm location voip_public 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 10 80.XXX.XXX.3
nat (inside) 10 192.168.10.0 255.255.255.0 0 0
static (inside,outside) voip_public 192.168.20.20 netmask
255.255.255.255 0 0
static (inside,outside) webaddress web_mail_server netmask
255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 80.XXX.XXX.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.10.30 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet XXX.XXX.XXX.xXX 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username XXXXXXXXXXXXX password *********
vpdn enable outside
dhcpd address 192.168.10.33-192.168.10.59 inside
dhcpd dns 80.254.161.126 80.254.161.125
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
 
Reply With Quote
 
 
 
 
Walter Roberson
Guest
Posts: n/a
 
      06-17-2004
In article < >,
Ben Bosshardt <> wrote:
:For some reason it is still
:impossible to reach my webserver from outside on 80.XXX.XXX.2 which is
:static on 192.168.20.5.

IX Version 6.3(3)

:name 80.XXX.XXX.2 webaddress
:name 192.168.20.5 web_mail_server
:access-list outside_access_in permit tcp any host webaddress eq www

:ip address outside 80.XXX.XXX.6 255.255.255.248
:ip address inside 192.168.10.1 255.255.0.0

:static (inside,outside) webaddress web_mail_server netmask 255.255.255.255 0 0
:access-group outside_access_in in interface outside

Those look okay. Did you clear xlate after making the changes?
--
This signature intentionally left... Oh, darn!
 
Reply With Quote
 
 
 
 
Ben Bosshardt
Guest
Posts: n/a
 
      06-18-2004
(Walter Roberson) wrote in message news:<cast8g$vt$>...
> Those look okay. Did you clear xlate after making the changes?

Thanks Walter. Yes, I did clear xlate but still fail with this coniguration.

Regards,
Ben
 
Reply With Quote
 
Ben Bosshardt
Guest
Posts: n/a
 
      07-09-2004
Thanks Ahmed

Below you find the configuration I had before I changed the webserver
to 192.168.20.X. It still don't understand why I cant't resolve this
problem.

Regards,
Ben

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXXX encrypted
hostname PIX
domain-name any.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 80.XXX.XXX.2 webaddress
name 192.168.20.5 web_mail_server
name 80.XXX.XXX.5 voip_public
access-list outside_access_in permit tcp any host voip_public eq 5060
access-list outside_access_in permit tcp any host voip_public range
10000 20000
access-list outside_access_in permit tcp any host webaddress eq www
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 80.XXX.XXX.6 255.255.255.248
ip address inside 192.168.10.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.10.30 255.255.255.255 inside
pdm location 192.168.10.5 255.255.255.255 inside
pdm location 192.168.10.96 255.255.255.224 outside
pdm location 192.168.10.15 255.255.255.255 inside
pdm location 192.168.10.105 255.255.255.255 inside
pdm location 192.168.10.14 255.255.255.255 inside
pdm location webaddress 255.255.255.255 outside
pdm location 192.168.10.20 255.255.255.255 inside
pdm location 192.168.10.0 255.255.255.0 inside
pdm location web_mail_server 255.255.255.255 inside
pdm location 192.168.20.20 255.255.255.255 inside
pdm location voip_public 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 10 80.XXX.XXX.3
nat (inside) 10 192.168.10.0 255.255.255.0 0 0
static (inside,outside) voip_public 192.168.20.20 netmask
255.255.255.255 0 0
static (inside,outside) webaddress web_mail_server netmask
255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 80.XXX.XXX.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.10.30 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet XXX.XXX.XXX.xXX 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username XXXXXXXXXXXXX password *********
vpdn enable outside
dhcpd address 192.168.10.33-192.168.10.59 inside
dhcpd dns 80.254.161.126 80.254.161.125
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80

(Ahmed Basar) wrote in message news:< om>...
> Your inside network is 192.168.10.X and your internal web-site is on
> different network which is 192.168.20.x., try mapping your internal Ip
> 192.168.10.20 to the external network IP address of 80.X.x.x.
>
> Thanks
> Ahmed Basar
> CCNP, CCNA
>
> (Ben Bosshardt) wrote in message news:<. com>...
> > After some hints out of this newsgroup, I reconfigured my firewall and
> > came up with the settings below. For some reason it is still
> > impossible to reach my webserver from outside on 80.XXX.XXX.2 which is
> > static on 192.168.20.5. Can anyone spot the mistake I made right away?
> >
> > Thanks for your help
> > Ben
> >
> >
> >
> > PIX Version 6.3(3)
> > interface ethernet0 auto
> > interface ethernet1 auto
> > nameif ethernet0 outside security0
> > nameif ethernet1 inside security100
> > enable password XXXXXXXXXXXXXXXXX encrypted
> > passwd XXXXXXXXXXXXXXX encrypted
> > hostname PIX
> > domain-name any.com
> > fixup protocol dns maximum-length 512
> > fixup protocol ftp 21
> > fixup protocol h323 h225 1720
> > fixup protocol h323 ras 1718-1719
> > fixup protocol http 80
> > fixup protocol pptp 1723
> > fixup protocol rsh 514
> > fixup protocol rtsp 554
> > fixup protocol sip 5060
> > fixup protocol sip udp 5060
> > fixup protocol skinny 2000
> > fixup protocol smtp 25
> > fixup protocol sqlnet 1521
> > fixup protocol tftp 69
> > names
> > name 80.XXX.XXX.2 webaddress
> > name 192.168.20.5 web_mail_server
> > name 80.XXX.XXX.5 voip_public
> > access-list outside_access_in permit tcp any host voip_public eq 5060
> > access-list outside_access_in permit tcp any host voip_public range
> > 10000 20000
> > access-list outside_access_in permit tcp any host webaddress eq www
> > pager lines 24
> > mtu outside 1500
> > mtu inside 1500
> > ip address outside 80.XXX.XXX.6 255.255.255.248
> > ip address inside 192.168.10.1 255.255.0.0
> > ip audit info action alarm
> > ip audit attack action alarm
> > pdm location 192.168.10.30 255.255.255.255 inside
> > pdm location 192.168.10.5 255.255.255.255 inside
> > pdm location 192.168.10.96 255.255.255.224 outside
> > pdm location 192.168.10.15 255.255.255.255 inside
> > pdm location 192.168.10.105 255.255.255.255 inside
> > pdm location 192.168.10.14 255.255.255.255 inside
> > pdm location webaddress 255.255.255.255 outside
> > pdm location 192.168.10.20 255.255.255.255 inside
> > pdm location 192.168.10.0 255.255.255.0 inside
> > pdm location web_mail_server 255.255.255.255 inside
> > pdm location 192.168.20.20 255.255.255.255 inside
> > pdm location voip_public 255.255.255.255 inside
> > pdm history enable
> > arp timeout 14400
> > global (outside) 10 80.XXX.XXX.3
> > nat (inside) 10 192.168.10.0 255.255.255.0 0 0
> > static (inside,outside) voip_public 192.168.20.20 netmask
> > 255.255.255.255 0 0
> > static (inside,outside) webaddress web_mail_server netmask
> > 255.255.255.255 0 0
> > access-group outside_access_in in interface outside
> > route outside 0.0.0.0 0.0.0.0 80.XXX.XXX.1 1
> > timeout xlate 3:00:00
> > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
> > 1:00:00
> > timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
> > timeout uauth 0:05:00 absolute
> > aaa-server TACACS+ protocol tacacs+
> > aaa-server RADIUS protocol radius
> > aaa-server LOCAL protocol local
> > http server enable
> > http 192.168.10.30 255.255.255.255 inside
> > no snmp-server location
> > no snmp-server contact
> > snmp-server community public
> > no snmp-server enable traps
> > floodguard enable
> > sysopt connection permit-pptp
> > telnet XXX.XXX.XXX.xXX 255.255.255.255 inside
> > telnet timeout 5
> > ssh timeout 5
> > console timeout 0
> > vpdn username XXXXXXXXXXXXX password *********
> > vpdn enable outside
> > dhcpd address 192.168.10.33-192.168.10.59 inside
> > dhcpd dns 80.254.161.126 80.254.161.125
> > dhcpd lease 3600
> > dhcpd ping_timeout 750
> > dhcpd enable inside
> > terminal width 80
 
Reply With Quote
 
Walter Roberson
Guest
Posts: n/a
 
      07-10-2004
In article < >,
Ben Bosshardt <> wrote:
:Below you find the configuration I had before I changed the webserver
:to 192.168.20.X. It still don't understand why I cant't resolve this
roblem.

IX Version 6.3(3)
:ip address inside 192.168.10.1 255.255.0.0

dm location 192.168.10.0 255.255.255.0 inside

Wrong netmask on that pdm location.

:nat (inside) 10 192.168.10.0 255.255.255.0 0 0

Wrong netmask on that 'nat' statement. Nothing in 192.168.20.* that
is on the inside would be translated -- packets from those
addresses would just be dropped.
--
Tenser, said the Tensor.
Tenser, said the Tensor.
Tension, apprehension,
And dissension have begun. -- Alfred Bester (tDM)
 
Reply With Quote
 
Ben Bosshardt
Guest
Posts: n/a
 
      07-10-2004
> dm location 192.168.10.0 255.255.255.0 inside
>
> Wrong netmask on that pdm location.
>
> :nat (inside) 10 192.168.10.0 255.255.255.0 0 0
>
> Wrong netmask on that 'nat' statement. Nothing in 192.168.20.* that
> is on the inside would be translated -- packets from those
> addresses would just be dropped.

I am still running the configuration I had on 06/17 when I started
this article. In there I have:

pdm location 192.168.10.30 255.255.255.255 inside
pdm location 192.168.10.5 255.255.255.255 inside

and

nat (inside) 10 192.168.10.0 255.255.255.0 0 0
static (inside,outside) 80.XXX.XXX.2 192.168.20.5 netmask
255.255.255.255 0 0

After you helped me out in May I changed the webserver to a different
subnet in order to avoid the overlapping subnets you warned me about.
I probably misunderstood you.
 
Reply With Quote
 
 
 
Reply

« Partioned Flash | Field Notice: New 7204VXR and 7206VXR Chassis Are Incompatible With Older PA-8B-S/T »
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Beginners Problem - Static reference to non-static method William Colls Java 4 03-20-2012 06:28 PM
Problem: shared object loading runs constructor of a static object, but static linkage does not. tropos C++ 3 11-30-2005 04:54 PM
PIX public/24 ip static mapping means 256 times interfaces static maps? Nieuws Xs4all Cisco 2 05-26-2005 06:25 PM
PIX public/24 ip static mapping means 256 times interfaces static maps? Nieuws Xs4all Cisco 0 05-26-2005 11:07 AM
Static vs. non-static connection Natan ASP .Net 8 05-26-2004 08:21 AM



Advertisments
 


Powered by vBulletin®. Copyright ©2000 - 2013, vBulletin Solutions, Inc..
SEO by vBSEO ©2010, Crawlability, Inc.
Contact Us - Archive - Privacy Statement - Top

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57