[HELP] Cisco PIX 515 Port Forwarding

Hi everyone. I have a Cisco PIX 515 and am trying to do a simple task. When
somebody connects to an external IP address on a specific port I want it to
direct to an internal IP on a different port. For example, if somebody
connects to the external 215.152.16.8 on port 9386 I want it to map to port
2516 on 192.168.1.8. I know the command to map the IP is:

static (inside,outside) 215.152.16.8 192.168.1.8 netmask 255.255.255.255 0 0

What is the command to redirect the ports? Does this command look right?

static (inside,outside) tcp 215.152.16.8 9386 192.168.1.8 2516 netmask
255.255.255.255 0 0

Thanks for the help. Raven.

 

:Hi everyone. I have a Cisco PIX 515 and am trying to do a simple task. When
:somebody connects to an external IP address on a specific port I want it to
:direct to an internal IP on a different port. For example, if somebody
:connects to the external 215.152.16.8 on port 9386 I want it to map to port
:2516 on 192.168.1.8. I know the command to map the IP is:

:static (inside,outside) 215.152.16.8 192.168.1.8 netmask 255.255.255.255 0 0

:What is the command to redirect the ports? Does this command look right?

:static (inside,outside) tcp 215.152.16.8 9386 192.168.1.8 2516 netmask 255.255.255.255 0 0

Looks right to me.

You will of course need an access-list permitting the traffic,
applied to the outside interface via the 'access-group' command.

 

Just to add to Walter's statement, the release notes for 6.3.3 state that
it is the last major release to support conduit.

Rik Bain

 

Thanks for the reply. Please let me know if these are the commands I need to
add.

static (inside,outside) tcp 215.152.16.8 9386 192.168.1.8 2516 netmask
255.255.255.255 0 0
conduit permit tcp host 215.152.16.8 eq 9386 any

I appreciate the help.

 

:Thanks for the reply. Please let me know if these are the commands I need to
:add.

:static (inside,outside) tcp 215.152.16.8 9386 192.168.1.8 2516 netmask 255.255.255.255 0 0
:conduit permit tcp host 215.152.16.8 eq 9386 any

The extended version of 'static' has been supported since PIX 6.0(1),
and Cisco has been recommending against using 'conduit' since PIX 5.1(2)
or so. Cisco does not promise that conduits will function properly with
PIX 6 features such as port forwarding. I would highly recommend
that you use access-list and access-group instead.