asked on 12/2/2004

Pix 501

I'm attempting to use a firewall (PIX 501) to accomplish the following:

Keep a PC outside our network because a vender dials into to it for application maintenance. We don't want him in our network. The PC is configured with a private IP (192.168.0.3 255.255.255.0) but should be reachable from inside our Class B network( 138.187.0.0) via an IP (138.187.31.97) [I can ping it now using 138.187.31.97, but I would like to be able remote desktop to it. If that can be done then I might also want it to get WUs and NVirus updates from our network inside but this is not a priority]

When I attempt to remote to the PC outside I get messages like: "There are currently no logon servers available to service the logon request" but I can remote to this PC if it is moved to the inside network and configured it one of our IPs such as 138.187.31.97.

I can ping the pix from the inside using 138.187.32.47. I can ping the pix from outside using 192.168.0.1. I can ping everything on our inside network from the outside PC. [I know this is not good but my main interest for this question is to be able to remote to the the PC outside.]

Below is the last config I applied. Below that is the screen text that came back with a couple of messages when I applied the config.

LAST CONFIG APPLIED:
pix# show config
: Saved
: Written by enable_15 at 12:50:56.457 UTC Thu Dec 2 2004
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 inside security100
nameif ethernet1 outside security0
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_in permit ip any host 138.187.31.97
access-list outside_in permit icmp any any
access-list inside_in permit udp any any eq domain
access-list inside_in permit icmp any any
pager lines 24
logging on
logging console errors
logging monitor debugging
logging buffered debugging
mtu inside 1500
mtu outside 1500
ip address inside 192.168.0.1 255.255.255.0
ip address outside 138.187.32.47 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 138.187.31.97 192.168.0.3 netmask 255.255.255.255 0 0
access-group inside_in in interface inside
access-group outside_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 60
ssh timeout 60
console timeout 0
terminal width 100
Cryptochecksum:ccaed19464c5cd922e327549500a19d3

SCREEN TEXT
pixfirewall# conf t
pixfirewall(config)# interface ethernet0 auto
pixfirewall(config)# interface ethernet1 100full
pixfirewall(config)# nameif ethernet0 inside security100
interface 1 name "inside" swapped with interface 0 name "outside"
pixfirewall(config)# nameif ethernet1 outside security0
pixfirewall(config)# hostname pix
pix(config)# fixup protocol dns maximum-length 512
pix(config)# fixup protocol ftp 21
pix(config)# fixup protocol h323 h225 1720
pix(config)# fixup protocol h323 ras 1718-1719
pix(config)# fixup protocol http 80
pix(config)# fixup protocol ils 389
pix(config)# fixup protocol rsh 514
pix(config)# fixup protocol rtsp 554
pix(config)# fixup protocol sip 5060
pix(config)# fixup protocol sip udp 5060
pix(config)# fixup protocol skinny 2000
pix(config)# fixup protocol smtp 25
pix(config)# fixup protocol sqlnet 1521
pix(config)# fixup protocol tftp 69
pix(config)# names
pix(config)# access-list outside_in permit ip any host 138.187.31.97
pix(config)# access-list outside_in permit icmp any any
pix(config)# access-list inside_in permit udp any any eq domain
pix(config)# access-list inside_in permit icmp any any
pix(config)# pager lines 24
pix(config)# logging on
pix(config)# logging console errors
pix(config)# logging monitor debugging
pix(config)# logging buffered debugging
pix(config)# mtu outside 1500
pix(config)# mtu inside 1500
pix(config)# ip address inside 192.168.0.1 255.255.255.0
pix(config)# ip address outside 138.187.32.47 255.255.0.0
pix(config)# ip audit info action alarm
pix(config)# ip audit attack action alarm
pix(config)# pdm history enable
pix(config)# arp timeout 14400
pix(config)# global (outside) 1 interface
outside interface address added to PAT pool
pix(config)# nat (inside) 1 0.0.0.0 0.0.0.0 0 0
pix(config)# static (inside,outside) 138.187.31.97 192.168.0.3 netmask 255.255$
pix(config)# access-group outside_in in interface outside
pix(config)# access-group inside_in in interface inside
pix(config)# timeout xlate 3:00:00
pix(config)# timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 $
pix(config)# timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
pix(config)# timeout uauth 0:05:00 absolute
pix(config)# aaa-server TACACS+ protocol tacacs+
pix(config)# aaa-server RADIUS protocol radius
pix(config)# aaa-server LOCAL protocol local
pix(config)# no snmp-server location
pix(config)# no snmp-server contact
pix(config)# snmp-server community public
pix(config)# no snmp-server enable traps
pix(config)# floodguard enable
pix(config)# telnet timeout 60
pix(config)# ssh timeout 60
pix(config)# console timeout 0
pix(config)# terminal width 100
pix(config)# write mem
Building configuration...
Cryptochecksum: ccaed194 64c5cd92 2e327549 500a19d3
[OK]
pix(config)# reload
Proceed with reload? [confirm]

Rebooting....

Software Firewalls Cisco

Last Comment