Link to home
Start Free TrialLog in
Avatar of Benjovy1
Benjovy1

asked on

PIX 501 port redirection

I have a PIX 501 at a customer site.  I am trying to do a port redirection for PC anywhere to server 192.168.201.  The current port redirection work fine to 192.168.0.4.  I've added the lines into the config that should have worked to redirect PC anywhere to 192.168.0.201.....but no joy.  Pls Help!!!
=============================================================

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxx.com.au
clock timezone EST 10
clock summer-time EDT recurring last Sun Oct 2:00 last Sun Mar 3:00
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
names
name 192.168.0.2 Server01
name 192.168.0.4 Server02
name 192.168.0.201 SCADA001
object-group service Peer2Peer tcp-udp
  description Blocks port ranges for Emule, Kazaa, Limewire, Morpheus
  port-object range 6346 6347
  port-object range 4661 4662
  port-object range 1214 1214
object-group service OutboundTraffic tcp-udp
  description Allowable Outbound ports
  port-object range 3389 3389
  port-object range 20 21
  port-object range 110 110
  port-object range 80 80
  port-object range 25 25
  port-object range 5900 5900
  port-object range 443 443
  port-object range 5631 5632
object-group service AllPorts tcp-udp
  port-object range 1 65535
object-group network WinServers
  network-object Server01 255.255.255.255
  network-object Server02 255.255.255.255
  network-object SCADA001 255.255.255.255
access-list outside_access_in permit tcp any host X.X.X.188 eq smtp
access-list outside_access_in permit tcp any host X.X.X.188 eq 3389
access-list outside_access_in permit tcp any host X.X.X.188 eq https
access-list outside_access_in permit tcp any host X.X.X.188 eq www
access-list outside_access_in permit tcp any host SCADA001 range pcanywhere-data
 5632
access-list outside_access_in permit udp any host SCADA001 range 5631 pcanywhere
-status
access-list inside_outbound_nat0_acl permit ip any 192.168.1.0 255.255.255.128
access-list inside_outbound_nat0_acl permit ip any 192.168.1.96 255.255.255.240
access-list inside_outbound_nat0_acl permit ip any 192.168.0.240 255.255.255.248

access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168
.0.240 255.255.255.248
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.0 255.255.255.128
access-list inside_access_in permit udp object-group WinServers any
access-list inside_access_in permit tcp any any object-group OutboundTraffic
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside X.X.X.186 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool dhcp_vpn 192.168.1.1-192.168.1.100
ip local pool pptp_pool2 192.168.0.241-192.168.0.245
pdm location Server01 255.255.255.255 inside
pdm location 192.168.1.96 255.255.255.240 outside
pdm location 192.168.0.240 255.255.255.248 outside
pdm location 192.168.1.0 255.255.255.128 outside
pdm location Server02 255.255.255.255 inside
pdm location SCADA001 255.255.255.255 inside
pdm group WinServers inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 X.X.X.187
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) Server01 Server01 netmask 255.255.255.255 0 0
static (inside,outside) X.X.X.188 Server02 netmask 255.255.255.255 0 0
static (inside,outside) tcp X.X.X.188 5631 SCADA001 5631 netmask 255.255.255.255 0 0
static (inside,outside) UDP X.X.X.188 5632 SCADA001 5632 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 X.X.X.185 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host Server01 hello timeout 10
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client configuration address respond
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet Server01 255.255.255.255 inside
telnet Server02 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
vpdn username administrator password *********
vpdn enable outside
vpdn enable inside
username admin password XXXXXXXXXXXX encrypted privilege 15
terminal width 80
: end
Avatar of batry_boy
batry_boy
Flag of United States of America image

You are trying to use the same external IP address for 192.168.0.201 as you are already using for 192.168.0.4.  You will need to choose a different public IP address for the "static" command that references 192.168.0.201 (SCADA001).  Also, you need to specify the public translated address for the destination in the "access-list" command rather than the private address.

So, for example, if x.x.x.189 were available and you decided to use it for translating 192.168.0.201, then you would put in the following commands:

static (inside,outside) tcp x.x.x.189 5631 SCADA001 5631 netmask 255.255.255.255
static (inside,outside) udp x.x.x.189 5632 SCADA001 5632 netmask 255.255.255.255
access-list outside_access_in permit tcp any host x.x.x.189 range pcanywhere-data 5632
access-list outside_access_in permit udp any host x.x.x.189 range 5631 pcanywhere-status

Avatar of Benjovy1
Benjovy1

ASKER

I havent got any other public IP addresses available.  Is there any other solution?
ASKER CERTIFIED SOLUTION
Avatar of batry_boy
batry_boy
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks batry boy...
I'm doing this remotely...fingers crossed
Thanks again :)
Thanks batry boy.  
I just had to run clear xlate & it worked.  Full points
Excellent...glad to help!