<div>
If you're trying to give outside folks access to your servers and such inside the firewall, you will need to add a static translation to your NAT table, giving those internal devices external IPs. &nbsp;Once the internal device is reachable by the outside world, you'll then set your rules. &nbsp;You'll want to allow SSH (preferably only from specific IPs) and disallow all else, to maintain the highest level of security possible.<br />
<br />
Shawn<br />
<br />
Shawn Preston, CISSP<br />
Founder, SecureThinking<br />
<a href="http://www.securethinking.net" rel="ugc">www.securethinking.net</a><br />
<br />
&quot;Where Information Security Evolves&quot;<br />

</div>


If you're trying to give outside folks access to your servers and such inside the firewall, you will need to add a static translation to your NAT table, giving those internal devices external IPs.  Once the internal device is reachable by the outside world, you'll then set your rules.  You'll want to allow SSH (preferably only from specific IPs) and disallow all else, to maintain the highest level of security possible.

Shawn

Shawn Preston, CISSP
Founder, SecureThinking
www.securethinking.net [http://www.securethinking.net]

"Where Information Security Evolves"


<div>
I am looking for the exact commands on how to do a static traslation on a PIX. I appreciate yuor help
</div>


I am looking for the exact commands on how to do a static traslation on a PIX. I appreciate yuor help

<div>
Assuming that you have a pool of IP addresses to choose from, make sure that the static global addresses are removed from the nat pool. We'd have to see your complete config to make many more detailed recommendations:<br />
<br />
PIX#config t<br />
PIX(config)# static (inside,outside)&lt;global ip&gt; &lt;local ip&gt; netmask 255.255.255.255<br />

</div>


Assuming that you have a pool of IP addresses to choose from, make sure that the static global addresses are removed from the nat pool. We'd have to see your complete config to make many more detailed recommendations:

PIX#config t
PIX(config)# static (inside,outside)<global ip> <local ip> netmask 255.255.255.255


<div>
<div class="content wysiwyg-content">
I am trying to figure out how to give access to outside vendors to inside servers through SSH. I have been able to coonct to the PIX using SSH but how do I configure the PIX to allow outside clients to get to inside resouses using SSH?
</div>
</div>


I am trying to figure out how to give access to outside vendors to inside servers through SSH. I have been able to coonct to the PIX using SSH but how do I configure the PIX to allow outside clients to get to inside resouses using SSH?

SSH and PIX 515

Software firewalls, also known as host-based firewalls, provide a layer of software on one host that controls network traffic in and out of that single machine. Most operating systems now include firewall software, but many available software firewalls include central distribution, antivirus systems and disaster recovery.

Software Firewalls

Cisco PIX is a dedicated hardware firewall appliance; the Cisco Adaptive Security Appliance (ASA) is a firewall and anti-malware security appliance that provides unified threat management and protection the PIX does not. Other Cisco devices and systems include routers, switches, storage networking, wireless and the software and hardware for PIX Firewall Manager (PFM), PIX Device Manager (PDM) and Adaptive Security Device Manager (ASDM).