Hall of Fame

1. keith_ala...41,675
2. deimark32,175
3. decoleur23,982
4. JFrederic...23,686
5. dpk_wal22,500
6. bignewf19,500
7. MikeKane19,246
8. lrmoore18,650
9. arnold17,215
10. ccomley15,260
11. rsivanandan14,294
12. Raj-GT13,500
13. uetian170711,244
14. giltjr10,550
15. sangamc8,500
16. grimkin8,150
17. PeteLong7,300
18. DaveHowe7,035
19. David-Ho...6,400
20. Cyclops3...6,300
20. Voltz-dk6,300
22. asavener6,000
23. ricks_v5,789
24. Qlemo5,600
25. pand0ra...5,568

1. lrmoore2,083,543
2. keith_ala...1,142,637
3. rsivanandan362,956
4. tim_holman340,612
5. calvinetter305,130
6. nodisco218,025
7. srikrishnak210,854
8. grblades201,484
9. carribeant...160,647
10. Voltz-dk154,414
11. batry_boy152,604
12. pruecons...104,029
13. harbor235101,676
14. stressedo...97,372
15. Cyclops3...94,275
16. JFrederic...91,686
17. dpk_wal88,797
18. PeteLong88,574
19. MikeKane86,248
20. jjoseph_x84,774
21. billwharton82,785
22. ccomley82,536
23. jabiii82,486
24. td_miles78,871
25. jasonpaine73,268

	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.2

pix501 static ip mapping and port forwarding

Asked by daveky in Network Software Firewalls

Tags: ip, port, pix, static, mapping

I looked at this:

http://www.experts-exchange.com/Security/Firewalls/Q_21562130.html?qid=21562130

and it makes perfect sense to me. We are doing similar stuff:

static (inside,outside) tcp interface 2121 [internal IP of hosted server] ftp netmask 255.255.255.255 0 0
access-list OUTSIDEACL permit tcp host [ip of our office] host [external IP avalaible on pix] eq 2121

ie we map a port (2121 in this case) on the external ip of the pix throught to a different port (21 here) on a specific intenal ip at our dedicated hosting.

However we also have specific external-to-intenal ip mappings. Like:

static (inside,outside) [available external IP on pix] [internal IP of hosted server] netmask 255.255.255.255 0 0

Then we allow certain ports through for that mapping (sometimes only allowing access from specific ips as is sensible for ssh):

access-list OUTSIDEACL permit tcp any host [available external IP on pix] eq www
access-list OUTSIDEACL permit host [ip of our office] host [available external IP on pix] eq ssh

Super. But my boss now wants to mask those ports. So that ssh(22) or ftp(21) are not available on the outside but perhaps 2121 and 2222 are. But I am not able to work out the syntax for this port mapping when we have a dedicated external IP for an inernal server. I can only do "pass through" ports. I would guess for the access-list it would be:

access-list OUTSIDEACL permit host [ip of our office] [ecernal port to connect on] host [available external IP on pix] eq [internal port to forward to]

But this does not actually forward the port, it just allows the traffic. How do you forward one port to another if you have all traffic for an external ip pushed to an internal ip. Not possible? Cheers, D.

View the Solution FREE for 30 Days

20091021-EE-VQP-81

pix501 static ip mapping and port forwarding

Asked by daveky in Network Software Firewalls

Tags: ip, port, pix, static, mapping

About this solution