Improve company productivity with a Business Account.Sign Up

x
?
Solved

PIX Firewall / Network Address Translation

Posted on 2004-04-01
11
Medium Priority
?
1,194 Views
Last Modified: 2010-04-11
Got a problem, and I've no clue where to start. (Unfortunately, I'm not the one who gets to make decisions here, they just want me to fix what they break.)

We've got a new Cisco PIX Firewall installed, and it's supposed to be handling our Network Address Translation. (NAT.)  However, it was configured to do Port Address Translation (PAT) on the IP of the PIX's interface.  After awhile, my users would complain to me that they would often try to go to  a website and have to hit "refresh" a number of times before their sites would come up.  I was under the ASSUMPTION that this was because the PAT was running out of ports for all of the users.  We have an address pool ranging from x.x.x.146 (the PIX) to x.x.x.155, with .147 being our mail server.  So I switched the settings on the PIX to do a "Range" from .148 to .155.  This seems to have only caused MORE trouble.  

Anyone have any suggestions?

-Javin
0
Comment
Question by:Javin007
  • 5
  • 3
  • 2
  • +1
11 Comments
 
LVL 11

Expert Comment

by:geoffryn
ID: 10733488
How many user do you have behind the PIX?  It should take quite a few to exhaust the overloaded PAT address.
0
 
LVL 11

Accepted Solution

by:
billwharton earned 1500 total points
ID: 10734331
You are not exactly using PAT very well. What you are doing is using a scope of 7 IP addresses or 7 connections to access the Internet. When these 7 connections are exhausted, that's when you have to press the 'reload' button. Use this statement instead. It will allow you thousands of connections.

Your global command should currently look like this:
global (outside) __ x.x.x.148-x.x.x.155 -> The blank is simply an ID no.

Simply negate this command out and put a new one:
global (outside) __ x.x.x.150 -> Use the same ID no. as you did before.

That's it. Reboot the PIX and ask all your users to try accessing the internet and see if they face any problems.

Do let me know how it goes.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10735534
billwharton:

I think I understand what you're saying, and I think it's the same conclusion I came to before.  Doing a "Range" setup actually maps the users to the outside IPs, giving them all ports on an IP mapped to their own.  Thus, 7 IPs = 7 Users online.  

I've switched it back over to "interface PAT" in the meantime, where the ports of the PIX's IP were being utilized for the port address translation.  This brings us back to our original problem.  

Based on what you said, I tried adding each additional IP to the same "pool" (by default, 10) as a PAT IP, and removed the "interface PAT" (which is the PIX's IP).  This gives me the 7 IPs (in theory) running port address translation.  If this IS what you were talking about, and is what I should do, let me know.

The thing that bothers me about this whole thing, is that I understand that each hit to a webpage can make up to half a dozen connections, and those connections can hang on for 2-15 minutes.  But would you REALLY be likely to run out of ports for translation, even with one IP, with only 40 users on the network?

-Javin
0
Building an Effective Phishing Protection Program

Join Director of Product Management Todd OBoyle on April 26th as he covers the key elements of a phishing protection program. Whether you’re an old hat at phishing education or considering starting a program -- we'll discuss critical components that should be in any program.

 

Expert Comment

by:tpacc
ID: 10736239
Well, I don't exactly understand your last post completely.

Are you comfortable using interface PAT for the long term? There is no reason why you should. Hence, you can simply forget about ip to ip nat since that isin't needed in this place.

Interface PAT should not give you any problems. I've had environments running more than 10,000 connections on a PIX 515 using just one IP.
0
 

Expert Comment

by:tpacc
ID: 10736445
Javin

The posting by tpacc was actually authored by me. You can reply to it.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10737436
Well, thus far, interface PAT has given us issues that we didn't have before (on the old network) when doing network address translation (NAT) through software.  

It didn't make sense to me that 40 users would crowd out all the connections on Interface PAT to start with, but either way, we're running into this issue.  And the issue has ONLY come about since installing the PIX, and ONLY happens when there are a "lot" of users online at once.  The question here is how to fix the problem, whatever it may be.  Do you have any suggestion for troubleshooting that I can use to chase down the issue?

-Javin
0
 
LVL 11

Expert Comment

by:billwharton
ID: 10737445
try the 'show xlate' command when users complain and see how many connections do you see in there.

Also try 'show cpu usage'
0
 
LVL 4

Author Comment

by:Javin007
ID: 10737718
Remember that I'm not using the terminal connection, but I'm using the PIX GUI.

-Javin
0
 
LVL 11

Expert Comment

by:billwharton
ID: 10738034
No problem
in PDM, you have a section called 'monitoring'
Click on that and you would find multiple options on left including System graphs -> CPU and Connection graphs -> xlates

Check all of those to see the PIX is running fine.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10744275
Will have to get back to you next week.  Work's done for the weekend.  ;)

-Javin
0
 
LVL 4

Author Comment

by:Javin007
ID: 10766670
Well, things seem to be straightened out, now.  I don't know how, but the users DID seem to be using up all the ports.  Having added the additional IPs appears to have fixed the problem.  Thanks for the help!

-Javin
0

Featured Post

Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This applies to Dell but may also apply to other manufacturers as well. We ran across a few machines that just dropped recently it trust relationship with the server. After doing the basic removing and joining the domain again, it changed to No logo…
There are a few different ways to preview your site before DNS resolves it to your (mt) Media Temple server.  The Plesk platform makes it easy.  See the following guide to learn how.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

606 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question