Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

PIX 501 Configuration

Posted on 2004-10-26
8
Medium Priority
?
247 Views
Last Modified: 2013-11-16
Hi,

I currently have 2 servers, 1 exchange/web and 1 web server. I would like to move the web sites from the exchange server to the web server.

The exchange server sits on the external interface and incoming/outgoing traffic works Ok.

I have 4 other static IP addresses that I can use for the other server.

I have configured the PIX (config below) however I am unable to connect to the server from the outside.

Can some please take a look at the config and point me in the right direction.

Many thanks
Gary

PIX Version 6.3(1)
interface ethernet0 10full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 3ZtzQ2gGeo1S02Pe encrypted
hostname ALPHF001
domain-name PIX
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside_in permit tcp any interface outside eq www
access-list outside_in permit tcp any interface outside eq smtp
access-list outside_in permit tcp any interface outside eq https
access-list outside_in permit icmp any any echo-reply
access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www
access-list in_outside permit ip any any
access-list in_outside permit tcp any any
access-list in_outside permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.0.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.0.5 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.0.5 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
access-group outside_in in interface outside
access-group in_outside in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:db4ae1f9e57703db3c847dac49a8e899
: end
[OK]

0
Comment
Question by:garyboulter0997
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 1000 total points
ID: 12421095
You need an access-list entry to match your static:
 >static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
> access-list outside_in permit tcp any interface outside eq www
ADD:
   access-list outside_in permit tcp any host xxx.xxx.xxx.xxx eq www
DELETE:
   access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www

Reapply the access-list to the interface
   access-group outside_in in interface outside

<== please remove this entry:
access-group in_outside in interface inside
0
 

Author Comment

by:garyboulter0997
ID: 12421569
Hi,

Added and removed the entries you mentioned. However I am still unable to reach the second
web server.

As a total newbie, can you explain why
-  <== please remove this entry:
- access-group in_outside in interface inside


Thanks
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12421777
Assuming that the ISP is properly routing this second IP address to you, all you need in the PIX is the static and the acl entry, and the acl re-applied.

Troubleshooting now goes to the server. Can you reach the web interface from the internal network? Is the server's default gateway pointing to the PIX IP?
Are you trying this from a remote client outside the network? Or are you trying to use the public IP from your workstation inside the network? You can't go to the public IP from inside (just the way nat works on PIX).

By default, all traffic originating on the inside of the network is allowed out. Unless and until you want to RESTRICT that behavior, you do not apply ANY access-list to the inside interface. Especially since that acl says "permit ip any any".
 Best thing to do in your case is
   no access-group in_outside in interface inside
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 

Author Comment

by:garyboulter0997
ID: 12422007

ISP routing appears to be Ok,

a 'show xlate' display has the correct static and inside IP addresses along with the connecting port.

I am attempting to connect from a remote client sitting on the outside, 'Gateway 504 messages are returned.' from the browser.

No, I cannot reach the web from the inside. (had not intended to at this time.)
If I attempt to insert the default gateway to the pix on the second server I get a warning.

Thanks for the inside explanation, makes sense.

0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12422092
>If I attempt to insert the default gateway to the pix on the second server I get a warning.
What kind of warning? The PIX has to be the server's default gateway (assuming it is on the same subnet) in order to respond to the www access request..unless you have another router on the inside that redirects users to the PIX...


0
 

Author Comment

by:garyboulter0997
ID: 12422193

Both servers are the same subnet 192.168.0.5 & 6

Em... The exchange server also provides a gateway for the internal 10.0.0.X this has its external Nic set as the gatway to the PIX.

0
 

Author Comment

by:garyboulter0997
ID: 12427756
After pointing me in right direction, reconfiguring the network architecture everything is working as it should be

Many thanks for you assistance.

0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12427778
Good news!
Glad to help.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

597 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question