PIX 501 Configuration

Hi,

I currently have 2 servers, 1 exchange/web and 1 web server. I would like to move the web sites from the exchange server to the web server.

The exchange server sits on the external interface and incoming/outgoing traffic works Ok.

I have 4 other static IP addresses that I can use for the other server.

I have configured the PIX (config below) however I am unable to connect to the server from the outside.

Can some please take a look at the config and point me in the right direction.

Many thanks
Gary

PIX Version 6.3(1)
interface ethernet0 10full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 3ZtzQ2gGeo1S02Pe encrypted
hostname ALPHF001
domain-name PIX
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside_in permit tcp any interface outside eq www
access-list outside_in permit tcp any interface outside eq smtp
access-list outside_in permit tcp any interface outside eq https
access-list outside_in permit icmp any any echo-reply
access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www
access-list in_outside permit ip any any
access-list in_outside permit tcp any any
access-list in_outside permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.0.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.0.5 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.0.5 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
access-group outside_in in interface outside
access-group in_outside in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:db4ae1f9e57703db3c847dac49a8e899
: end
[OK]

garyboulter0997Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

lrmooreCommented:
You need an access-list entry to match your static:
 >static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
> access-list outside_in permit tcp any interface outside eq www
ADD:
   access-list outside_in permit tcp any host xxx.xxx.xxx.xxx eq www
DELETE:
   access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www

Reapply the access-list to the interface
   access-group outside_in in interface outside

<== please remove this entry:
access-group in_outside in interface inside
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
garyboulter0997Author Commented:
Hi,

Added and removed the entries you mentioned. However I am still unable to reach the second
web server.

As a total newbie, can you explain why
-  <== please remove this entry:
- access-group in_outside in interface inside


Thanks
0
lrmooreCommented:
Assuming that the ISP is properly routing this second IP address to you, all you need in the PIX is the static and the acl entry, and the acl re-applied.

Troubleshooting now goes to the server. Can you reach the web interface from the internal network? Is the server's default gateway pointing to the PIX IP?
Are you trying this from a remote client outside the network? Or are you trying to use the public IP from your workstation inside the network? You can't go to the public IP from inside (just the way nat works on PIX).

By default, all traffic originating on the inside of the network is allowed out. Unless and until you want to RESTRICT that behavior, you do not apply ANY access-list to the inside interface. Especially since that acl says "permit ip any any".
 Best thing to do in your case is
   no access-group in_outside in interface inside
0
Top Threats of Q1 & How to Defend Against Them

WEBINAR: Join WatchGuard CTO and our Threat Research Team on Aug. 2nd to hear the findings from our Q1 Internet Security Report! Learn more about the top threats detected in the first quarter and how you can defend your business against them!

garyboulter0997Author Commented:

ISP routing appears to be Ok,

a 'show xlate' display has the correct static and inside IP addresses along with the connecting port.

I am attempting to connect from a remote client sitting on the outside, 'Gateway 504 messages are returned.' from the browser.

No, I cannot reach the web from the inside. (had not intended to at this time.)
If I attempt to insert the default gateway to the pix on the second server I get a warning.

Thanks for the inside explanation, makes sense.

0
lrmooreCommented:
>If I attempt to insert the default gateway to the pix on the second server I get a warning.
What kind of warning? The PIX has to be the server's default gateway (assuming it is on the same subnet) in order to respond to the www access request..unless you have another router on the inside that redirects users to the PIX...


0
garyboulter0997Author Commented:

Both servers are the same subnet 192.168.0.5 & 6

Em... The exchange server also provides a gateway for the internal 10.0.0.X this has its external Nic set as the gatway to the PIX.

0
garyboulter0997Author Commented:
After pointing me in right direction, reconfiguring the network architecture everything is working as it should be

Many thanks for you assistance.

0
lrmooreCommented:
Good news!
Glad to help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.