Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

PIX 506e and opening ports

Posted on 2004-08-13
6
293 Views
Last Modified: 2013-11-16
I have a new pix firewall that i am trying to configure.  what do i need to do to open up ports mail & ftp to my internal server. i have already assigned ip addresses to the interfaces outside and inside.

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.7


0
Comment
Question by:adamshields
  • 4
  • 2
6 Comments
 
LVL 36

Expert Comment

by:grblades
ID: 11799840
Hi adamshields,
I assume there is a typo in your diagram above as the same IP is assigned to the server and the pix internal interface.

I assume you have a single IP address and you want to redirect mail and ftp sent to the external IP address of your PIX to your server.
Add the following to the PIX configuration:-

access-list outside_in permit tcp any any eq ftp
access-list outside_in permit tcp any any eq smtp
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.1.7 smtp netmask 255.255.255.255 0 0
access-group outside_in in interface outside
0
 
LVL 36

Expert Comment

by:grblades
ID: 11799844
0
 
LVL 3

Author Comment

by:adamshields
ID: 11820742
yes it was a typo
                                                                       
static (inside,outside) tcp interface ftp 192.168.1.7 ftp netmask 255.255.255.255 0 0
                                                                      ^
                                                                      .3 ?
is this right ? change 7 to .3 for the server ??

Internet T1
     |
     |
outside 68.209.131.xxx
     |
pixfirewall
     |
inside  192.168.1.7
    |
SERVER 192.168.1.3

0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 36

Accepted Solution

by:
grblades earned 500 total points
ID: 11822513
Yes thats correct.
0
 
LVL 3

Author Comment

by:adamshields
ID: 11827052
thanks for the help

one more thing what does the 0 0 mean at the end of the command ?
0
 
LVL 36

Expert Comment

by:grblades
ID: 11827982
The two extra parameters which are zero above are max_conns and em_limit :-

max_conns :-
Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.)
Note This option does not apply to outside NAT. The firewall only tracks connections from a higher security interface to a lower security interface. If you set max_conns for outside NAT, the max_conns option is ignored.

em_limit :-
Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections.
The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. When the embryonic limit is surpassed, the TCP intercept feature intercepts TCP synchronization (SYN) packets from clients to servers on a higher security level. The software establishes a connection with the client on behalf of the destination server, and if successful, establishes the connection with the server on behalf of the client and combines the two half-connections together transparently. Thus, connection attempts from unreachable hosts never reach the server. The PIX firewall accomplishes TCP intercept functionality using SYN cookies.
Note This option does not apply to outside NAT. The TCP intercept feature applies only to hosts or servers on a higher security level. If you set the embryonic limit for outside NAT, the embryonic limit is ignored.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question