Question

515E PIX one-to-one NAT

Asked by: mthomas4

Hi Experts,

I'm getting very frustrated trying to configure what I thought was supposed to be a relatively straight-forward task.

I recently got a /29 point-to-point connection from my ISP, and have configured my outside interface accordingly (216.16.243.178 255.255.255.248). It's my understanding that I should be able to specify a NAT static (inside,outside) type rule to map public IPs to specific machines on my inside interface.

I've inherited this PIX config, and I have a feeling I'm missing something. Everything I've read says I should able to do what I'm trying to do. I can't seem to get any traffic to reach the servers unless I use 216.16.243.178 as my public IP in DNS, AND if I specify that IP in my rule (instead of 'interface IP') it no longer works.

What the heck is going on? I've attached the config as I have a feeling something is conflicting or I need another access-rule or something. I'm hoping a trained eye can spot something amiss.

Thanks.

: Saved
:
PIX Version 7.2(2) 
!
hostname eei-pix
domain-name eei.com
enable password xxxx encrypted
names
!
interface Ethernet0
 nameif outside
 security-level 0
 ip address 216.16.243.178 255.255.255.248 
!
interface Ethernet1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
interface Ethernet2
 nameif dmz
 security-level 50
 ip address 10.30.30.10 255.255.255.0 
!
passwd xxxx encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
 domain-name eei.com
access-list outside_access_in remark Providing Public HTTP access to the DMZ Web Server
access-list outside_access_in extended permit tcp any interface outside eq www 
access-list outside_access_in extended permit icmp any any echo-reply 
access-list outside_access_in extended permit tcp any interface outside eq smtp 
access-list outside_access_in extended permit tcp any interface outside eq pop3 
access-list outside_access_in extended permit tcp any interface outside eq https 
access-list outside_access_in extended permit tcp any interface outside eq 4443 
access-list outside_access_in extended permit tcp any interface outside eq 81 
access-list outside_access_in extended permit tcp any interface outside eq 8080 
access-list outside_access_in extended permit tcp any interface outside eq 3389 
access-list eeiPIX_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.10.10.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 209.165.201.0 255.255.255.224 
access-list dmz_to_inside extended permit ip any any 
access-list nonatdmz extended permit ip 10.30.30.0 255.255.255.0 10.10.10.0 255.255.255.0 
access-list split extended permit ip 192.168.1.0 255.255.255.0 10.10.10.0 255.255.255.0 
access-list split extended permit ip 10.30.30.0 255.255.255.0 10.10.10.0 255.255.255.0 
pager lines 24
logging enable
logging console debugging
logging monitor debugging
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool eeivpnpool 10.10.10.1-10.10.10.50 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm
no asdm history enable
arp timeout 14400
global (outside) 200 interface
global (inside) 1 192.168.1.199 netmask 255.255.255.255
global (dmz) 200 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 200 192.168.1.0 255.255.255.0
nat (dmz) 0 access-list nonatdmz
nat (dmz) 200 10.30.30.30 255.255.255.255
static (inside,outside) tcp interface pop3 192.168.1.200 pop3 netmask 255.255.255.255 
static (inside,outside) tcp interface 444 192.168.1.200 444 netmask 255.255.255.255 
static (inside,outside) tcp interface 3389 192.168.1.199 3389 netmask 255.255.255.255 
static (inside,outside) tcp interface 81 192.168.1.200 81 netmask 255.255.255.255 
static (inside,outside) tcp interface smtp 192.168.1.200 smtp netmask 255.255.255.255 
static (dmz,outside) tcp interface 8443 10.30.30.30 8443 netmask 255.255.255.255 
static (dmz,outside) tcp interface https 10.30.30.30 https netmask 255.255.255.255 
static (dmz,outside) tcp interface 8081 10.30.30.30 8081 netmask 255.255.255.255 
static (dmz,outside) tcp interface 8080 10.30.30.30 8080 netmask 255.255.255.255 
static (dmz,outside) tcp interface 4443 10.30.30.30 4443 netmask 255.255.255.255 
static (inside,outside) tcp interface www 192.168.1.198 www netmask 255.255.255.255 
static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 
access-group outside_access_in in interface outside
access-group dmz_to_inside in interface dmz
route outside 0.0.0.0 0.0.0.0 216.16.243.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy eeiPIX internal
group-policy eeiPIX attributes
 wins-server value 192.168.1.200 192.168.1.199
 dns-server value 192.168.1.200 63.208.196.92
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value eeiPIX_splitTunnelAcl
 default-domain value eei.com
group-policy eeiPIX! internal
group-policy eeiPIX! attributes
 wins-server value 192.168.1.200 192.168.1.199
 dns-server value 192.168.1.200 63.208.196.92
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split
 default-domain value eei.com
username eeipix password xxxx encrypted privilege 15
username eeivpn password xxxx encrypted privilege 0
username eeivpn attributes
 vpn-group-policy eeiPIX!
http server enable
http 192.168.1.10 255.255.255.255 inside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt connection tcpmss 1200
sysopt noproxyarp inside
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
tunnel-group eeiPIX type ipsec-ra
tunnel-group eeiPIX general-attributes
 address-pool eeivpnpool
 default-group-policy eeiPIX!
tunnel-group eeiPIX ipsec-attributes
 pre-shared-key *
 isakmp ikev1-user-authentication none
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
management-access inside
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip 
  inspect xdmcp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:xxxx
: end
asdm image flash:/asdm
no asdm history enable

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:

Select all Open in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2009-11-03 at 06:41:14ID24867148
Topics: Enterprise Firewalls
,; Networking Hardware Firewalls
,; Network Routers
Participating Experts: 2
Points: 500
Comments: 16

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: MikeKanePosted on 2009-11-03 at 07:01:29ID: 25729550

As it stands, you have a bunch of statics that do the port forwarding. I'd like to see the code that you tried for the 1 to 1 statics....

Usually, all you need, are the following:

static (inside,outside) <outside ip> <inside ip> netmask <sm Mask>

access-list outside-in extended permit ip any <outside ip>

access-group outside-in in interface outside

by: mthomas4Posted on 2009-11-03 at 07:48:01ID: 25730076

Something like this:

static (inside,outside) 216.16.243.178 192.168.1.198 netmask 255.255.255.255 0 0

Of course I'm getting conflicts because of the PAT system in place now. I'm hesitant to rip out all the PAT rules to try this new approach when I'm not entirely convinced my external IP block is functional. I've changed the DNS entry for my OWA website, and I can't connect on any IP except 216.16.243.178 (the beginning of my range).

Does it matter if I specify "outside interface IP" vs. explicitly defining an IP in that range? 216.16.243.180 should be within the 216.16.243.178/29 range, right? Why does this work?

by: rochey2009Posted on 2009-11-03 at 07:50:27ID: 25730103

Hi,

did you make any change to your outside_access_in acl?

by: mthomas4Posted on 2009-11-03 at 07:57:18ID: 25730205

It looks like I will have to, but honestly I'm VERY new to the CLI, and the GUI (ASDM) has all different terminology. In the GUI they're called "security policies". I added one for outside(incoming) rules to allow that IP, but it didn't seem to make any difference.

It really seems like it's an access-list problem blocking the request, but climbing around the CLI is driving me insane. The config file is 6 or 7 screens long, and whenever I want to reference another rule I have to page through the whole config file, then write it down on paper, so I can try another command. I'm just having a really hard time keeping track of all this mess :(

by: rochey2009Posted on 2009-11-03 at 08:13:18ID: 25730430

just add the following to the config substituting x.x.x.x for each external ip address and yyyy for the port you wish to open.

access-list outside_access_in extended permit tcp any host x.x.x.x eq yyyy

by: mthomas4Posted on 2009-11-03 at 08:45:08ID: 25730824

I've added an access-list of the form:

access-list outside_access_in extended permit tcp any host x.x.x.x eq yyyy

I'm still not having any luck specifying a specific external IP for NAT. I switch it back to "interface IP" and it works like a charm, specific IP, zero connectivity. I need to get this sorted out to get multiple servers with SSL serving pages on the default port (rather than cooking up non-standard ports to route traffic).

Is there any logging tool that will help me figure out where the packets are being rejected? and WHY?

by: rochey2009Posted on 2009-11-03 at 08:46:32ID: 25730846

Can you post the static nats your trying to implement.

by: mthomas4Posted on 2009-11-03 at 10:01:28ID: 25731656

My first baby step is trying to change something like this

static (inside,outside) tcp interface 81 192.168.1.200 netmask 255.255.255.255

into

static (inside,outside) tcp interface 81 216.16.243.178 tcp interface 81 192.168.1.200 netmask 255.255.255.255

I'm sure the syntax is wrong on that second command. I just want to change the rule from taking all incoming connections on port 81 and mapping them to port 81 on a specific external IP. Adding to my confusion is that when I specify the specific IP that all requests come in on currently (and work when I just say "interface IP"), nothing works.

by: rochey2009Posted on 2009-11-03 at 11:14:41ID: 25732394

Hi,

Try this

static (inside,outside) tcp 216.16.243.178 81 192.168.1.200 81 netmask 255.255.255.255

and make the relevant modification to the acl

access-list outside_access_in extended permit tcp any host 216.16.243.178 eq 81

by: mthomas4Posted on 2009-11-03 at 11:42:55ID: 25732687

Still no luck.

I get the sinking feeling that some rules are conflicting. I keep getting warnings in GUI about the static NAT entries conflicting. I just wish there was some sort of diagnostic tool that would let me see what was happening instead of stabbing away in the dark.

by: rochey2009Posted on 2009-11-03 at 11:46:42ID: 25732729

Did you remove the original static entry before you tried adding the new entry

e.g.
no static (inside,outside) tcp interface 81 192.168.1.200 81 netmask 255.255.255.255

by: MikeKanePosted on 2009-11-03 at 11:49:37ID: 25732766

There are only a few rules...

You can't static nat the same internal address to multiple externals.
You can't port forward to the same internal that has a 1 to 1.

If your goal is to have 216.16.243.178 map to internal 192.168.1.200 on all ports, then you just need....

static (inside,outside) 216.16.243.178 192.168.1.200 netmask 255.255.255.255

access-list outside-in extended permit tcp any host 216.16.243.178 eq 81

access-group outside-in in interface outside

Thats it...

by: mthomas4Posted on 2009-11-03 at 11:58:56ID: 25732886

Ok.

This PIX is our one an only point of access to the rest of the world, and it's used very heavily during weekdays (and weekday evenings). I think the weekend might be the first opportunity I have to do anything other than minor changes. i.e. removing all existing port translation and putting in one-to-one rules. Then testing, and verifying that everything works etc.

Thanks for your feedback, it'll be about a week before I can try anything else (we're a small SaaS company so I can't be bringing it down during the week to tinker).

by: rochey2009Posted on 2009-11-03 at 15:04:44ID: 25734880

Hi,

For testing purposes, you could do a translation to one of the other outside ip address (not the interface address).

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

515E PIX one-to-one NAT

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Enterprise Firewalls

Networking Hardware Firewalls

Network Routers

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press