[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 267
  • Last Modified:

PIX506e basic config

Hi, recently we have purchased a PIX506e to replace our existing firewall. Since I am new to working with the PIX and the CLI to manage it, I seek your advice on how to setup a basic configuration on it. In short, we're on a flat 192.168.x.x/16 network. Some important servers and the existing one to one NAT

mail: public: x.x.x.55 private
Web Server: public x.x.x.56 private

Here is the current config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxx encrypted
hostname SPARKY
domain-name pix.com
clock timezone PST -8
clock summer-time PDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit tcp any host X.XX.55
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside X.X.X.126
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) X.X.X.55 netmask 0 0
route outside X.X.X.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community hello
no snmp-server enable traps
floodguard enable
telnet inside
telnet timeout 15
ssh inside
ssh timeout 5
console timeout 0
terminal width 80
: end

What I am trying to understand is if setting up a global NAT pool vs PAT would be ideal, especially since we will be using this as the VPN server. If NAT is the appropriate choice, whats the proper commands to setup a static nat of to x.x.x.55?
1 Solution
It depends, the more NATs you have the more resources it consumes, memory in this case for the NAT translation table. . PAT is robust and your 506 should be able to handle a fair amount. Given src, dst, and port number your connection will be unique. Since this device is also a VPN termination point then you need to assess memory allocation, cpu utilization as so on to verify the are no resource limitations. However,
a good network desigh will distribute functions to the different layers (core, distribution, access) , this classic design scales and will conserver resources.

static (inside,outside) x.x.x.55 netmask yy.yy.yy.yy 0 0


Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now