[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

PIX 506e and opening ports

Posted on 2004-08-13
6
Medium Priority
?
376 Views
Last Modified: 2013-11-16
I have a new pix firewall that i am trying to configure.  what do i need to do to open up ports mail & ftp to my internal server. i have already assigned ip addresses to the interfaces outside and inside.

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.7


0
Comment
Question by:adamshields
  • 4
  • 2
6 Comments
 
LVL 36

Expert Comment

by:grblades
ID: 11799840
Hi adamshields,
I assume there is a typo in your diagram above as the same IP is assigned to the server and the pix internal interface.

I assume you have a single IP address and you want to redirect mail and ftp sent to the external IP address of your PIX to your server.
Add the following to the PIX configuration:-

access-list outside_in permit tcp any any eq ftp
access-list outside_in permit tcp any any eq smtp
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.1.7 smtp netmask 255.255.255.255 0 0
access-group outside_in in interface outside
0
 
LVL 36

Expert Comment

by:grblades
ID: 11799844
0
 
LVL 3

Author Comment

by:adamshields
ID: 11820742
yes it was a typo
                                                                       
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
                                                                      ^
                                                                      .3 ?
is this right ? change 7 to .3 for the server ??

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.3

0
Become an IT Security Management Expert

In today’s fast-paced, digitally transformed world of business, the need to protect network data and ensure cloud privacy has never been greater. With a B.S. in Network Operations and Security, you can get the credentials it takes to become an IT security management expert.

 
LVL 36

Accepted Solution

by:
grblades earned 2000 total points
ID: 11822513
Yes thats correct.
0
 
LVL 3

Author Comment

by:adamshields
ID: 11827052
thanks for the help

one more thing what does the 0 0 mean at the end of the command ?
0
 
LVL 36

Expert Comment

by:grblades
ID: 11827982
The two extra parameters which are zero above are max_conns and em_limit :-

max_conns :-
Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.)
Note This option does not apply to outside NAT. The firewall only tracks connections from a higher security interface to a lower security interface. If you set max_conns for outside NAT, the max_conns option is ignored.

em_limit :-
Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections.
The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. When the embryonic limit is surpassed, the TCP intercept feature intercepts TCP synchronization (SYN) packets from clients to servers on a higher security level. The software establishes a connection with the client on behalf of the destination server, and if successful, establishes the connection with the server on behalf of the client and combines the two half-connections together transparently. Thus, connection attempts from unreachable hosts never reach the server. The PIX firewall accomplishes TCP intercept functionality using SYN cookies.
Note This option does not apply to outside NAT. The TCP intercept feature applies only to hosts or servers on a higher security level. If you set the embryonic limit for outside NAT, the embryonic limit is ignored.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
Just after setting up Cloud PBX connectivity and migrated Skype users to SFBO, we noticed inbound calls not working but outbound calls would work.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question