garyboulter0997
asked on
PIX 501 Configuration
Hi,
I currently have 2 servers, 1 exchange/web and 1 web server. I would like to move the web sites from the exchange server to the web server.
The exchange server sits on the external interface and incoming/outgoing traffic works Ok.
I have 4 other static IP addresses that I can use for the other server.
I have configured the PIX (config below) however I am unable to connect to the server from the outside.
Can some please take a look at the config and point me in the right direction.
Many thanks
Gary
PIX Version 6.3(1)
interface ethernet0 10full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 3ZtzQ2gGeo1S02Pe encrypted
hostname ALPHF001
domain-name PIX
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside_in permit tcp any interface outside eq www
access-list outside_in permit tcp any interface outside eq smtp
access-list outside_in permit tcp any interface outside eq https
access-list outside_in permit icmp any any echo-reply
access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www
access-list in_outside permit ip any any
access-list in_outside permit tcp any any
access-list in_outside permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.0.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.0.5 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.0.5 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
access-group outside_in in interface outside
access-group in_outside in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:db4ae1f9e57
: end
[OK]
I currently have 2 servers, 1 exchange/web and 1 web server. I would like to move the web sites from the exchange server to the web server.
The exchange server sits on the external interface and incoming/outgoing traffic works Ok.
I have 4 other static IP addresses that I can use for the other server.
I have configured the PIX (config below) however I am unable to connect to the server from the outside.
Can some please take a look at the config and point me in the right direction.
Many thanks
Gary
PIX Version 6.3(1)
interface ethernet0 10full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 3ZtzQ2gGeo1S02Pe encrypted
hostname ALPHF001
domain-name PIX
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside_in permit tcp any interface outside eq www
access-list outside_in permit tcp any interface outside eq smtp
access-list outside_in permit tcp any interface outside eq https
access-list outside_in permit icmp any any echo-reply
access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www
access-list in_outside permit ip any any
access-list in_outside permit tcp any any
access-list in_outside permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.0.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.0.5 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.0.5 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
access-group outside_in in interface outside
access-group in_outside in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:db4ae1f9e57
: end
[OK]
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Assuming that the ISP is properly routing this second IP address to you, all you need in the PIX is the static and the acl entry, and the acl re-applied.
Troubleshooting now goes to the server. Can you reach the web interface from the internal network? Is the server's default gateway pointing to the PIX IP?
Are you trying this from a remote client outside the network? Or are you trying to use the public IP from your workstation inside the network? You can't go to the public IP from inside (just the way nat works on PIX).
By default, all traffic originating on the inside of the network is allowed out. Unless and until you want to RESTRICT that behavior, you do not apply ANY access-list to the inside interface. Especially since that acl says "permit ip any any".
Best thing to do in your case is
no access-group in_outside in interface inside
Troubleshooting now goes to the server. Can you reach the web interface from the internal network? Is the server's default gateway pointing to the PIX IP?
Are you trying this from a remote client outside the network? Or are you trying to use the public IP from your workstation inside the network? You can't go to the public IP from inside (just the way nat works on PIX).
By default, all traffic originating on the inside of the network is allowed out. Unless and until you want to RESTRICT that behavior, you do not apply ANY access-list to the inside interface. Especially since that acl says "permit ip any any".
Best thing to do in your case is
no access-group in_outside in interface inside
ASKER
ISP routing appears to be Ok,
a 'show xlate' display has the correct static and inside IP addresses along with the connecting port.
I am attempting to connect from a remote client sitting on the outside, 'Gateway 504 messages are returned.' from the browser.
No, I cannot reach the web from the inside. (had not intended to at this time.)
If I attempt to insert the default gateway to the pix on the second server I get a warning.
Thanks for the inside explanation, makes sense.
>If I attempt to insert the default gateway to the pix on the second server I get a warning.
What kind of warning? The PIX has to be the server's default gateway (assuming it is on the same subnet) in order to respond to the www access request..unless you have another router on the inside that redirects users to the PIX...
What kind of warning? The PIX has to be the server's default gateway (assuming it is on the same subnet) in order to respond to the www access request..unless you have another router on the inside that redirects users to the PIX...
ASKER
Both servers are the same subnet 192.168.0.5 & 6
Em... The exchange server also provides a gateway for the internal 10.0.0.X this has its external Nic set as the gatway to the PIX.
ASKER
After pointing me in right direction, reconfiguring the network architecture everything is working as it should be
Many thanks for you assistance.
Many thanks for you assistance.
Good news!
Glad to help.
Glad to help.
ASKER
Added and removed the entries you mentioned. However I am still unable to reach the second
web server.
As a total newbie, can you explain why
- <== please remove this entry:
- access-group in_outside in interface inside
Thanks