Solved
How do I set up an incoming static connection to a server on a different subnet?
Posted on 2004-09-19
Hi,
I need to set up an incoming connection to a server(192.168.5.26) on one of my subnets for an application vendor. I have a Pix 515 Firewall with a Cisco 2621 Router behind it connecting 5 other subnets. All internet traffic goes through the router to the Pix and then out.
Pix outside IF: xx.xx.232.201
Pix inside IF: 192.168.1.1
Router 192.168.1.2
Local network: 192.168.1.0
other subnets: 2.0, 3.0, 4.0, 5.0, 6.0 (joined through point to point T-1's)
Following other questions I found here, I added the following:
static (inside,outside) xx.xx.232.204 192.168.5.26 netmask 255.255.255.255 0 0
access-list test1 permit tcp host xx.xx.61.2 host xx.xx.232.204 eq 3389
access-group test1 in interface outside
Unfortunately, this has not worked. I believe the problem is that the Pix doesn't know how to get a packet to the server at 5.26.
The reason I say this, is because if I change the static command to a server at 192.168.1.25, it works successfully. But it does not get across to 5.26. I am testing this from my home network before I set it up for the vendor.
I do have a:
route inside 192.168.5.0 255.255.255.0 192.168.1.2 1
statement on the Pix (amongst other routes). This has been handling all routing to that subnet all along. I'm thinking that the translation is ocurring on the outside interface and not being sent to the inside and therefore to the router at 1.2 Am I right on this?
Whether I'm right or not, how can I get this to work?
Eric