Solved

Cisco Pix Port Forwarding

Posted on 2004-03-26
9
3,187 Views
Last Modified: 2007-11-27
Hello I am trying to do the following.  

Asume one static external IP on a pix.  and 3 internal ips

I am hoping for a configuration that will forward requests on that single ip to internal machines by port(done this on so many soho firewalls, im sure cisco must be able to do it!)

SO..

Someone comes in on port 25 they need to be directed to say 10.0.0.1
comes in on port 80 directed to 10.0.0.2
port 110 10.0.0.3

all the same single external IP forwarding to different IPs internally based upon port.

Thanks :)
0
Comment
Question by:Brent92663
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
9 Comments
 
LVL 11

Expert Comment

by:geoffryn
ID: 10688528
What version of the PIX IOS are you using?
0
 

Author Comment

by:Brent92663
ID: 10688554
the latest..
0
 
LVL 11

Assisted Solution

by:geoffryn
geoffryn earned 50 total points
ID: 10688592
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 1

Accepted Solution

by:
dcrysler earned 200 total points
ID: 10688655
the static command is supposed to accomplish this,

static [(<prenat_if_name>,<postnat_if_name>)] {tcp | udp} {<global_ip> | interface } <global_port> <local_ip> <local_port> [netmask <mask>] [<max_conns> [em_limit]] [norandomseq]

examples;

static (dmz, outside) tcp interface 23 172.16.1.2 23
static (dmz, outside) tcp interface 8080 172.16.1.3 80
static (dmz, outside) tcp interface 21 172.16.1.4 21

0
 

Author Comment

by:Brent92663
ID: 10688786
So it has to be on a DMZ?  one of these servers is a domain controller..

Is it okay if its defined as being on the dmz?  will it affect LAN services?
0
 
LVL 1

Expert Comment

by:dcrysler
ID: 10688931
no, each interface can be given an alias name which makes the commands more readable.  A 2 interface firewall will typically have the names set to "inside" and "outside".  Many of the examples in my book also use a third interface called "dmz".

So I would try:

static (inside,outside) tcp interface 23 172.16.1.2 23 ....
0
 

Author Comment

by:Brent92663
ID: 10689211
Thanks guys! I will give it a whirl!
0
 

Author Comment

by:Brent92663
ID: 10689217
Also, which book is your book? If its considered spam to post it,, feel free to email me at brent.richardsREMOVETHIS@REMOVETHISissusa.com
0
 
LVL 1

Expert Comment

by:dcrysler
ID: 10689289
Not sure if its considered span so I'll try this...

Cisco Security Specialists Guide to PIX Firewalls.  It's worked out well for me, we just bought our first 2 501's a couple of months ago and it helped me do everything from the initial setup to vpn'ing between the two.

http://www.amazon.com/exec/obidos/tg/detail/-/1931836639/qid=1080322759/sr=1-1/ref=sr_1_1/103-6519157-6866262?v=glance&s=books

cheers
0

Featured Post

Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question