Solved

PIX 506e - Allow inbound traffic

Posted on 2004-04-01
6
864 Views
Last Modified: 2010-04-09
I am creating a new network nat'd behind a PIX 506e.  I still need to allow users in the original network to access the new network.  Outbound traffic works because the PIX allows this implicitly.  I will have to close this down in the near future.  I can't seem to allow any inbound traffic initiated from the outside.  The log shows  
 
 %PIX-3-305005: No translation group found for tcp src outside:55.55.55.55/2832 dst inside:10.0.0.1/445
 
Basically I want to allow everything from outside network 55.55.55.0/24 to the inside network 10.0.0.0/23.
0
Comment
Question by:bdebelius
  • 3
  • 2
6 Comments
 
LVL 45

Expert Comment

by:Kdo
ID: 10735657


I believe that your access list entry should look something like this:



access-list 160 permit ip  55.55.55.0 0.0.0.255 10.0.0.0/23 0.0.1.255
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 10736346
Kdo, the access-lists on a PIX use subnet masks. You must be more familiar with the access-lists on a router that use an inverse mask...

access-list outside_in permit ip 55.55.55.0 255.255.255.0 10.0.0.0 255.255.254.0
access-group outside_in in interface outside

0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 10736360
Oh, yes, assuming that you do not want to nat the traffic between 55.55.55.0 and 10.0.0.0, add these lines:

access-list no_nat permit 10.0.0.0 255.255.254.0 55.55.55.0 255.255.255.0
nat(inside) 0 access-list no_nat

0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 
LVL 45

Expert Comment

by:Kdo
ID: 10737135

Good catch....

I don't care how these devices represent the mask values internally -- you'd think that at least the language syntax would be similar.


:-)

0
 

Author Comment

by:bdebelius
ID: 10741104
Thanks lrmooore.  That worked.  But I have another question(s) about this.

How would I change the configuration to nat the outside address, so that they appear to be coming from the inside interface?

What would be the reasons to do or not to do this?  I understand nat going outbound is to hide the inside network, but why would I want to hide the outside network?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 10744277
You can nat the outside if you have some overlapping addresses, or routing issues. Otherwise, I can't think of any good reason to do it.

I have done it when I want to get to a customer's private IP addresses and they overlap with another customer's private IP addresses.

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now