Solved

PIX 501 Configuration

Posted on 2004-10-26
236 Views
Last Modified: 2013-11-16
Hi,

I currently have 2 servers, 1 exchange/web and 1 web server. I would like to move the web sites from the exchange server to the web server.

The exchange server sits on the external interface and incoming/outgoing traffic works Ok.

I have 4 other static IP addresses that I can use for the other server.

I have configured the PIX (config below) however I am unable to connect to the server from the outside.

Can some please take a look at the config and point me in the right direction.

Many thanks
Gary

PIX Version 6.3(1)
interface ethernet0 10full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 3ZtzQ2gGeo1S02Pe encrypted
hostname ALPHF001
domain-name PIX
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list outside_in permit tcp any interface outside eq www
access-list outside_in permit tcp any interface outside eq smtp
access-list outside_in permit tcp any interface outside eq https
access-list outside_in permit icmp any any echo-reply
access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www
access-list in_outside permit ip any any
access-list in_outside permit tcp any any
access-list in_outside permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.0.5 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.0.5 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.0.5 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
access-group outside_in in interface outside
access-group in_outside in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.5 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:db4ae1f9e57703db3c847dac49a8e899
: end
[OK]

0
Question by:garyboulter0997
    8 Comments
     
    LVL 79

    Accepted Solution

    by:
    You need an access-list entry to match your static:
     >static (inside,outside) tcp xxx.xxx.xxx.xxx www 192.168.0.6 www netmask 255.255.255.255 0 0
    > access-list outside_in permit tcp any interface outside eq www
    ADD:
       access-list outside_in permit tcp any host xxx.xxx.xxx.xxx eq www
    DELETE:
       access-list outside_in permit tcp host 192.168.0.6 host xxx.xxx.xxx.xxx eq www

    Reapply the access-list to the interface
       access-group outside_in in interface outside

    <== please remove this entry:
    access-group in_outside in interface inside
    0
     

    Author Comment

    by:garyboulter0997
    Hi,

    Added and removed the entries you mentioned. However I am still unable to reach the second
    web server.

    As a total newbie, can you explain why
    -  <== please remove this entry:
    - access-group in_outside in interface inside


    Thanks
    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    Assuming that the ISP is properly routing this second IP address to you, all you need in the PIX is the static and the acl entry, and the acl re-applied.

    Troubleshooting now goes to the server. Can you reach the web interface from the internal network? Is the server's default gateway pointing to the PIX IP?
    Are you trying this from a remote client outside the network? Or are you trying to use the public IP from your workstation inside the network? You can't go to the public IP from inside (just the way nat works on PIX).

    By default, all traffic originating on the inside of the network is allowed out. Unless and until you want to RESTRICT that behavior, you do not apply ANY access-list to the inside interface. Especially since that acl says "permit ip any any".
     Best thing to do in your case is
       no access-group in_outside in interface inside
    0
     

    Author Comment

    by:garyboulter0997

    ISP routing appears to be Ok,

    a 'show xlate' display has the correct static and inside IP addresses along with the connecting port.

    I am attempting to connect from a remote client sitting on the outside, 'Gateway 504 messages are returned.' from the browser.

    No, I cannot reach the web from the inside. (had not intended to at this time.)
    If I attempt to insert the default gateway to the pix on the second server I get a warning.

    Thanks for the inside explanation, makes sense.

    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    >If I attempt to insert the default gateway to the pix on the second server I get a warning.
    What kind of warning? The PIX has to be the server's default gateway (assuming it is on the same subnet) in order to respond to the www access request..unless you have another router on the inside that redirects users to the PIX...


    0
     

    Author Comment

    by:garyboulter0997

    Both servers are the same subnet 192.168.0.5 & 6

    Em... The exchange server also provides a gateway for the internal 10.0.0.X this has its external Nic set as the gatway to the PIX.

    0
     

    Author Comment

    by:garyboulter0997
    After pointing me in right direction, reconfiguring the network architecture everything is working as it should be

    Many thanks for you assistance.

    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    Good news!
    Glad to help.
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Course: JavaScript Coding - Massive 12-Part Bundle

    Regardless of your programming skill level, you'll go from basics to advanced concepts in a vast array of JavaScript subjects including Sammy.js, Agility.js, Ember.js, Node.js, jQuery, AJAX, Extjs, AngularJS, Knockout.js, and JSON.

    Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
    To setup a SonicWALL for policy based routing to be used with the Websense Content Gateway there are several steps that need to be completed. Below is a rough guide for accomplishing this. One thing of note is this guide is intended to assist in the…
    This video Micro Tutorial is the first in a two-part series that shows how to create and use custom scanning profiles in Nuance's PaperPort 14.5 (http://www.experts-exchange.com/articles/17490/). But the ability to create custom scanning profiles al…
    Want to pick and choose which updates you receive? Feel free to check out this quick video on how to manage your email notifications.

    845 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now