Solved

PIX Firewall / Network Address Translation

Posted on 2004-04-01
11
1,165 Views
Last Modified: 2010-04-11
Got a problem, and I've no clue where to start. (Unfortunately, I'm not the one who gets to make decisions here, they just want me to fix what they break.)

We've got a new Cisco PIX Firewall installed, and it's supposed to be handling our Network Address Translation. (NAT.)  However, it was configured to do Port Address Translation (PAT) on the IP of the PIX's interface.  After awhile, my users would complain to me that they would often try to go to  a website and have to hit "refresh" a number of times before their sites would come up.  I was under the ASSUMPTION that this was because the PAT was running out of ports for all of the users.  We have an address pool ranging from x.x.x.146 (the PIX) to x.x.x.155, with .147 being our mail server.  So I switched the settings on the PIX to do a "Range" from .148 to .155.  This seems to have only caused MORE trouble.  

Anyone have any suggestions?

-Javin
0
Comment
Question by:Javin007
  • 5
  • 3
  • 2
  • +1
11 Comments
 
LVL 11

Expert Comment

by:geoffryn
ID: 10733488
How many user do you have behind the PIX?  It should take quite a few to exhaust the overloaded PAT address.
0
 
LVL 11

Accepted Solution

by:
billwharton earned 500 total points
ID: 10734331
You are not exactly using PAT very well. What you are doing is using a scope of 7 IP addresses or 7 connections to access the Internet. When these 7 connections are exhausted, that's when you have to press the 'reload' button. Use this statement instead. It will allow you thousands of connections.

Your global command should currently look like this:
global (outside) __ x.x.x.148-x.x.x.155 -> The blank is simply an ID no.

Simply negate this command out and put a new one:
global (outside) __ x.x.x.150 -> Use the same ID no. as you did before.

That's it. Reboot the PIX and ask all your users to try accessing the internet and see if they face any problems.

Do let me know how it goes.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10735534
billwharton:

I think I understand what you're saying, and I think it's the same conclusion I came to before.  Doing a "Range" setup actually maps the users to the outside IPs, giving them all ports on an IP mapped to their own.  Thus, 7 IPs = 7 Users online.  

I've switched it back over to "interface PAT" in the meantime, where the ports of the PIX's IP were being utilized for the port address translation.  This brings us back to our original problem.  

Based on what you said, I tried adding each additional IP to the same "pool" (by default, 10) as a PAT IP, and removed the "interface PAT" (which is the PIX's IP).  This gives me the 7 IPs (in theory) running port address translation.  If this IS what you were talking about, and is what I should do, let me know.

The thing that bothers me about this whole thing, is that I understand that each hit to a webpage can make up to half a dozen connections, and those connections can hang on for 2-15 minutes.  But would you REALLY be likely to run out of ports for translation, even with one IP, with only 40 users on the network?

-Javin
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Expert Comment

by:tpacc
ID: 10736239
Well, I don't exactly understand your last post completely.

Are you comfortable using interface PAT for the long term? There is no reason why you should. Hence, you can simply forget about ip to ip nat since that isin't needed in this place.

Interface PAT should not give you any problems. I've had environments running more than 10,000 connections on a PIX 515 using just one IP.
0
 

Expert Comment

by:tpacc
ID: 10736445
Javin

The posting by tpacc was actually authored by me. You can reply to it.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10737436
Well, thus far, interface PAT has given us issues that we didn't have before (on the old network) when doing network address translation (NAT) through software.  

It didn't make sense to me that 40 users would crowd out all the connections on Interface PAT to start with, but either way, we're running into this issue.  And the issue has ONLY come about since installing the PIX, and ONLY happens when there are a "lot" of users online at once.  The question here is how to fix the problem, whatever it may be.  Do you have any suggestion for troubleshooting that I can use to chase down the issue?

-Javin
0
 
LVL 11

Expert Comment

by:billwharton
ID: 10737445
try the 'show xlate' command when users complain and see how many connections do you see in there.

Also try 'show cpu usage'
0
 
LVL 4

Author Comment

by:Javin007
ID: 10737718
Remember that I'm not using the terminal connection, but I'm using the PIX GUI.

-Javin
0
 
LVL 11

Expert Comment

by:billwharton
ID: 10738034
No problem
in PDM, you have a section called 'monitoring'
Click on that and you would find multiple options on left including System graphs -> CPU and Connection graphs -> xlates

Check all of those to see the PIX is running fine.
0
 
LVL 4

Author Comment

by:Javin007
ID: 10744275
Will have to get back to you next week.  Work's done for the weekend.  ;)

-Javin
0
 
LVL 4

Author Comment

by:Javin007
ID: 10766670
Well, things seem to be straightened out, now.  I don't know how, but the users DID seem to be using up all the ports.  Having added the additional IPs appears to have fixed the problem.  Thanks for the help!

-Javin
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question