Solved

PIX 506e and opening ports

Posted on 2004-08-13
6
269 Views
Last Modified: 2013-11-16
I have a new pix firewall that i am trying to configure.  what do i need to do to open up ports mail & ftp to my internal server. i have already assigned ip addresses to the interfaces outside and inside.

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.7


0
Comment
Question by:adamshields
  • 4
  • 2
6 Comments
 
LVL 36

Expert Comment

by:grblades
Comment Utility
Hi adamshields,
I assume there is a typo in your diagram above as the same IP is assigned to the server and the pix internal interface.

I assume you have a single IP address and you want to redirect mail and ftp sent to the external IP address of your PIX to your server.
Add the following to the PIX configuration:-

access-list outside_in permit tcp any any eq ftp
access-list outside_in permit tcp any any eq smtp
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.1.7 smtp netmask 255.255.255.255 0 0
access-group outside_in in interface outside
0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
0
 
LVL 3

Author Comment

by:adamshields
Comment Utility
yes it was a typo
                                                                       
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
                                                                      ^
                                                                      .3 ?
is this right ? change 7 to .3 for the server ??

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.3

0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 36

Accepted Solution

by:
grblades earned 500 total points
Comment Utility
Yes thats correct.
0
 
LVL 3

Author Comment

by:adamshields
Comment Utility
thanks for the help

one more thing what does the 0 0 mean at the end of the command ?
0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
The two extra parameters which are zero above are max_conns and em_limit :-

max_conns :-
Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.)
Note This option does not apply to outside NAT. The firewall only tracks connections from a higher security interface to a lower security interface. If you set max_conns for outside NAT, the max_conns option is ignored.

em_limit :-
Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections.
The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. When the embryonic limit is surpassed, the TCP intercept feature intercepts TCP synchronization (SYN) packets from clients to servers on a higher security level. The software establishes a connection with the client on behalf of the destination server, and if successful, establishes the connection with the server on behalf of the client and combines the two half-connections together transparently. Thus, connection attempts from unreachable hosts never reach the server. The PIX firewall accomplishes TCP intercept functionality using SYN cookies.
Note This option does not apply to outside NAT. The TCP intercept feature applies only to hosts or servers on a higher security level. If you set the embryonic limit for outside NAT, the embryonic limit is ignored.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now