PIX506e basic config

Posted on 2005-05-04
Last Modified: 2010-04-09

Hi, recently we have purchased a PIX506e to replace our existing firewall. Since I am new to working with the PIX and the CLI to manage it, I seek your advice on how to setup a basic configuration on it. In short, we're on a flat 192.168.x.x/16 network. Some important servers and the existing one to one NAT

mail: public: x.x.x.55 private
Web Server: public x.x.x.56 private

Here is the current config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxx encrypted
hostname SPARKY
clock timezone PST -8
clock summer-time PDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit tcp any host X.XX.55
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside X.X.X.126
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) X.X.X.55 netmask 0 0
route outside X.X.X.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community hello
no snmp-server enable traps
floodguard enable
telnet inside
telnet timeout 15
ssh inside
ssh timeout 5
console timeout 0
terminal width 80
: end

What I am trying to understand is if setting up a global NAT pool vs PAT would be ideal, especially since we will be using this as the VPN server. If NAT is the appropriate choice, whats the proper commands to setup a static nat of to x.x.x.55?
Question by:SANG501
    1 Comment
    LVL 32

    Accepted Solution

    It depends, the more NATs you have the more resources it consumes, memory in this case for the NAT translation table. . PAT is robust and your 506 should be able to handle a fair amount. Given src, dst, and port number your connection will be unique. Since this device is also a VPN termination point then you need to assess memory allocation, cpu utilization as so on to verify the are no resource limitations. However,
    a good network desigh will distribute functions to the different layers (core, distribution, access) , this classic design scales and will conserver resources.

    static (inside,outside) x.x.x.55 netmask yy.yy.yy.yy 0 0


    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
    Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now