<div>
Have a look at my configuration example:- 
<a href="http://www.gbnetwork.co.uk/networking/ciscopixhomedsl.html" rel="ugc">http://www.gbnetwork.co.uk/networking/ciscopixhomedsl.html</a> 
 
If you post your corrent configuration and the IP address of the FTP I can give you the exact commands you need to enter.
</div>

<div>
Ok, FTP server on the inside is 192.168.1.129, and I want outside traffic to come in over 64.4.114.93 
 
Thanks! 
------------ 
 
PIX Version 6.3(1) 
interface ethernet0 auto 
interface ethernet1 auto 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
enable password w3FcKWk5h7rQm0hV encrypted 
passwd RTTv556n5lLXj26X encrypted 
hostname rbipix 
domain-name rbi.com 
clock timezone EST -5 
clock summer-time EDT recurring 
fixup protocol ftp 21 
fixup protocol h323 h225 1720 
fixup protocol h323 ras 1718-1719 
fixup protocol http 80 
fixup protocol ils 389 
fixup protocol rsh 514 
fixup protocol rtsp 554 
fixup protocol sip 5060 
fixup protocol sip udp 5060 
fixup protocol skinny 2000 
no fixup protocol smtp 25 
fixup protocol sqlnet 1521 
names 
name 192.168.1.129 fileserv2 
name 64.4.114.93 ftpout 
object-group network allowed 
&nbsp; network-object 192.168.1.0 255.255.255.0 
access-list outside_in permit tcp any host 64.4.114.91 eq smtp 
access-list outside_in permit tcp any host 64.4.114.91 eq www 
access-list outside_in permit tcp any host 64.4.114.92 eq citrix-ica 
access-list outside_in permit gre any any 
access-list outside_in permit ah any any 
access-list inside-out permit icmp any any 
access-list 100 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
access-list oustide_in permit tcp any host ftpout eq ftp 
pager lines 24 
mtu outside 1500 
mtu inside 1500 
ip address outside 64.4.114.90 255.255.255.248 
ip address inside 192.168.1.1 255.255.255.0 
ip audit info action alarm 
ip audit attack action alarm 
pdm location 192.168.1.20 255.255.255.255 inside 
pdm location 192.168.1.10 255.255.255.255 inside 
pdm location 192.168.1.11 255.255.255.255 inside 
pdm location 64.83.59.229 255.255.255.255 outside 
pdm location 64.83.59.230 255.255.255.255 outside 
pdm location 192.168.1.5 255.255.255.255 inside 
pdm location 192.168.1.132 255.255.255.255 inside 
pdm location 192.168.1.148 255.255.255.255 inside 
pdm location 63.111.24.34 255.255.255.255 outside 
pdm location 192.168.1.3 255.255.255.255 inside 
pdm location 192.168.1.13 255.255.255.255 inside 
pdm location 192.168.69.0 255.255.255.0 outside 
pdm location 192.168.1.12 255.255.255.255 inside 
pdm location fileserv2 255.255.255.255 inside 
pdm location ftpout 255.255.255.255 outside 
pdm group allowed inside 
pdm logging informational 100 
pdm history enable 
arp timeout 14400 
global (outside) 10 interface 
global (outside) 1 ftpout 
nat (inside) 0 access-list 100 
nat (inside) 10 0.0.0.0 0.0.0.0 0 0 
static (inside,outside) 64.4.114.92 192.168.1.10 netmask 255.255.255.255 0 0 
static (inside,outside) 64.4.114.91 192.168.1.3 netmask 255.255.255.255 0 0 
access-group outside_in in interface outside 
route outside 0.0.0.0 0.0.0.0 64.4.114.89 1 
timeout xlate 0:05:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server LOCAL protocol local 
url-server (inside) vendor websense host 192.168.1.5 timeout 5 protocol TCP version 1 
filter url except 192.168.1.13 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 0.0.0.0 0.0.0.0 63.111.24.34 255.255.255.255 allow 
filter url except 192.168.1.148 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 192.168.1.132 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 
http server enable 
http 64.83.59.229 255.255.255.255 outside 
http 192.168.1.0 255.255.255.0 inside 
http 192.168.1.1 255.255.255.255 inside 
no snmp-server location 
no snmp-server contact 
snmp-server community gymdyw2day 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
crypto ipsec transform-set myset esp-des esp-md5-hmac 
crypto map transam 20 ipsec-isakmp 
crypto map transam 20 match address 101 
crypto map transam 20 set peer 24.125.92.123 
crypto map transam 20 set transform-set myset 
crypto map transam interface outside 
isakmp enable outside 
isakmp key ******** address 24.125.92.123 netmask 255.255.255.255 
isakmp identity address 
isakmp policy 10 authentication pre-share 
isakmp policy 10 encryption des 
isakmp policy 10 hash md5 
isakmp policy 10 group 1 
isakmp policy 10 lifetime 28800 
telnet 64.83.59.230 255.255.255.255 outside 
telnet 192.168.1.0 255.255.255.0 inside 
telnet timeout 30 
ssh 0.0.0.0 0.0.0.0 outside 
ssh timeout 5 
console timeout 0 
terminal width 80 
Cryptochecksum:395314402db3971c9630a6f24a03746a 
: end 

</div>

<div>
You already have the ftp traffic permitted in on your inbound access-list so all you need to add is the static NAT translation :- 
 
static (inside,outside) 64.4.114.93 192.168.1.129 netmask 255.255.255.255 0 0
</div>

<div>
Hrm, I still can't seem to access it from outside the network. &nbsp;Any ideas?
</div>

<div>
There is a typo in your access-list. Enter the following to fix :- 
 
no access-list oustide_in 
access-list outside_in permit tcp any host ftpout eq ftp 
</div>

<div>
hrm, i did that and still not luck, here's what I have right now: 
 
PIX Version 6.3(1) 
interface ethernet0 auto 
interface ethernet1 auto 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
enable password w3FcKWk5h7rQm0hV encrypted 
passwd RTTv556n5lLXj26X encrypted 
hostname rbipix 
domain-name rbi.com 
clock timezone EST -5 
clock summer-time EDT recurring 
fixup protocol ftp 21 
fixup protocol h323 h225 1720 
fixup protocol h323 ras 1718-1719 
fixup protocol http 80 
fixup protocol ils 389 
fixup protocol rsh 514 
fixup protocol rtsp 554 
fixup protocol sip 5060 
fixup protocol sip udp 5060 
fixup protocol skinny 2000 
no fixup protocol smtp 25 
fixup protocol sqlnet 1521 
names 
name 192.168.1.129 fileserv2 
name 64.4.114.93 ftpout 
object-group network allowed 
&nbsp; network-object 192.168.1.0 255.255.255.0 
access-list outside_in permit tcp any host ftpout eq ftp 
access-list inside-out permit icmp any any 
access-list 100 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
pager lines 24 
mtu outside 1500 
mtu inside 1500 
ip address outside 64.4.114.90 255.255.255.248 
ip address inside 192.168.1.1 255.255.255.0 
ip audit info action alarm 
ip audit attack action alarm 
pdm location 192.168.1.20 255.255.255.255 inside 
pdm location 192.168.1.10 255.255.255.255 inside 
pdm location 192.168.1.11 255.255.255.255 inside 
pdm location 64.83.59.229 255.255.255.255 outside 
pdm location 64.83.59.230 255.255.255.255 outside 
pdm location 192.168.1.5 255.255.255.255 inside 
pdm location 192.168.1.132 255.255.255.255 inside 
pdm location 192.168.1.148 255.255.255.255 inside 
pdm location 63.111.24.34 255.255.255.255 outside 
pdm location 192.168.1.3 255.255.255.255 inside 
pdm location 192.168.1.13 255.255.255.255 inside 
pdm location 192.168.69.0 255.255.255.0 outside 
pdm location 192.168.1.12 255.255.255.255 inside 
pdm location fileserv2 255.255.255.255 inside 
pdm location ftpout 255.255.255.255 outside 
pdm group allowed inside 
pdm logging informational 100 
pdm history enable 
arp timeout 14400 
global (outside) 10 interface 
global (outside) 1 ftpout 
nat (inside) 0 access-list 100 
nat (inside) 10 0.0.0.0 0.0.0.0 0 0 
static (inside,outside) 64.4.114.92 192.168.1.10 netmask 255.255.255.255 0 0 
static (inside,outside) 64.4.114.91 192.168.1.3 netmask 255.255.255.255 0 0 
static (inside,outside) ftpout fileserv2 netmask 255.255.255.255 0 0 
route outside 0.0.0.0 0.0.0.0 64.4.114.89 1 
timeout xlate 0:05:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server LOCAL protocol local 
url-server (inside) vendor websense host 192.168.1.5 timeout 5 protocol TCP version 1 
filter url except 192.168.1.13 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 0.0.0.0 0.0.0.0 63.111.24.34 255.255.255.255 allow 
filter url except 192.168.1.148 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 192.168.1.132 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 
http server enable 
http 64.83.59.229 255.255.255.255 outside 
http 192.168.1.0 255.255.255.0 inside 
http 192.168.1.1 255.255.255.255 inside 
no snmp-server location 
no snmp-server contact 
snmp-server community gymdyw2day 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
crypto ipsec transform-set myset esp-des esp-md5-hmac 
crypto map transam 20 ipsec-isakmp 
crypto map transam 20 match address 101 
crypto map transam 20 set peer 24.125.92.123 
crypto map transam 20 set transform-set myset 
crypto map transam interface outside 
isakmp enable outside 
isakmp key ******** address 24.125.92.123 netmask 255.255.255.255 
isakmp identity address 
isakmp policy 10 authentication pre-share 
isakmp policy 10 encryption des 
isakmp policy 10 hash md5 
isakmp policy 10 group 1 
isakmp policy 10 lifetime 28800 
telnet 64.83.59.230 255.255.255.255 outside 
telnet 192.168.1.0 255.255.255.0 inside 
telnet timeout 30 
ssh 0.0.0.0 0.0.0.0 outside 
ssh timeout 5 
console timeout 0 
terminal width 80 
Cryptochecksum:395314402db3971c9630a6f24a03746a 
: end 
 

</div>

<div>
actually, looking at this, i'll bet its all fine, and now I just need to add a statement to the router.
</div>

<div>
Here ya go, sorry I'm being such a end user on this. 
--- 
rbipix(config)# write terminal 
Building configuration... 
: Saved 
: 
PIX Version 6.3(1) 
interface ethernet0 auto 
interface ethernet1 auto 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
enable password w3FcKWk5h7rQm0hV encrypted 
passwd RTTv556n5lLXj26X encrypted 
hostname rbipix 
domain-name rbi.com 
clock timezone EST -5 
clock summer-time EDT recurring 
fixup protocol ftp 21 
fixup protocol h323 h225 1720 
fixup protocol h323 ras 1718-1719 
fixup protocol http 80 
fixup protocol ils 389 
fixup protocol rsh 514 
fixup protocol rtsp 554 
fixup protocol sip 5060 
fixup protocol sip udp 5060 
fixup protocol skinny 2000 
no fixup protocol smtp 25 
fixup protocol sqlnet 1521 
names 
name 192.168.1.129 fileserv2 
name 64.4.114.93 ftpout 
object-group network allowed 
&nbsp; network-object 192.168.1.0 255.255.255.0 
access-list outside_in permit tcp any host 64.4.114.91 eq smtp 
access-list outside_in permit tcp any host 64.4.114.91 eq www 
access-list outside_in permit tcp any host 64.4.114.92 eq citrix-ica 
access-list outside_in permit gre any any 
access-list outside_in permit tcp any host ftpout eq ftp 
access-list inside-out permit icmp any any 
access-list 100 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.69.0 255.255.255.0 
pager lines 24 
mtu outside 1500 
mtu inside 1500 
ip address outside 64.4.114.90 255.255.255.248 
ip address inside 192.168.1.1 255.255.255.0 
ip audit info action alarm 
ip audit attack action alarm 
pdm location 192.168.1.20 255.255.255.255 inside 
pdm location 192.168.1.10 255.255.255.255 inside 
pdm location 192.168.1.11 255.255.255.255 inside 
pdm location 64.83.59.229 255.255.255.255 outside 
pdm location 64.83.59.230 255.255.255.255 outside 
pdm location 192.168.1.5 255.255.255.255 inside 
pdm location 192.168.1.132 255.255.255.255 inside 
pdm location 192.168.1.148 255.255.255.255 inside 
pdm location 63.111.24.34 255.255.255.255 outside 
pdm location 192.168.1.3 255.255.255.255 inside 
pdm location 192.168.1.13 255.255.255.255 inside 
pdm location 192.168.69.0 255.255.255.0 outside 
pdm location 192.168.1.12 255.255.255.255 inside 
pdm location fileserv2 255.255.255.255 inside 
pdm location ftpout 255.255.255.255 outside 
pdm group allowed inside 
pdm logging informational 100 
pdm history enable 
arp timeout 14400 
global (outside) 10 interface 
global (outside) 1 ftpout 
nat (inside) 0 access-list 100 
nat (inside) 10 0.0.0.0 0.0.0.0 0 0 
static (inside,outside) 64.4.114.92 192.168.1.10 netmask 255.255.255.255 0 0 
static (inside,outside) 64.4.114.91 192.168.1.3 netmask 255.255.255.255 0 0 
static (inside,outside) ftpout fileserv2 netmask 255.255.255.255 0 0 
access-group outside_in in interface outside 
route outside 0.0.0.0 0.0.0.0 64.4.114.89 1 
timeout xlate 0:05:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server LOCAL protocol local 
url-server (inside) vendor websense host 192.168.1.5 timeout 5 protocol TCP version 1 
filter url except 192.168.1.13 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 0.0.0.0 0.0.0.0 63.111.24.34 255.255.255.255 allow 
filter url except 192.168.1.148 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url except 192.168.1.132 255.255.255.255 0.0.0.0 0.0.0.0 allow 
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 
http server enable 
http 64.83.59.229 255.255.255.255 outside 
http 192.168.1.0 255.255.255.0 inside 
http 192.168.1.1 255.255.255.255 inside 
no snmp-server location 
no snmp-server contact 
snmp-server community gymdyw2day 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
crypto ipsec transform-set myset esp-des esp-md5-hmac 
crypto map transam 20 ipsec-isakmp 
crypto map transam 20 match address 101 
crypto map transam 20 set peer 24.125.92.123 
crypto map transam 20 set transform-set myset 
crypto map transam interface outside 
isakmp enable outside 
isakmp key ******** address 24.125.92.123 netmask 255.255.255.255 
isakmp identity address 
isakmp policy 10 authentication pre-share 
isakmp policy 10 encryption des 
isakmp policy 10 hash md5 
isakmp policy 10 group 1 
isakmp policy 10 lifetime 28800 
telnet 64.83.59.230 255.255.255.255 outside 
telnet 192.168.1.0 255.255.255.0 inside 
telnet timeout 30 
ssh 0.0.0.0 0.0.0.0 outside 
ssh timeout 5 
console timeout 0 
terminal width 80 
Cryptochecksum:395314402db3971c9630a6f24a03746a 
: end 
[OK]
</div>

<div>
And it works! &nbsp;Thanks alot!! 
 
Josh
</div>

<div>
<div class="content wysiwyg-content">
Hey guys! &nbsp;I'd like to configure a PIX 506e to allow traffic coming in to be routed to an internal FTP server. &nbsp;Could you be able to help me out? &nbsp;Thanks! 
 
Josh
</div>
</div>

Hey guys!  I'd like to configure a PIX 506e to allow traffic coming in to be routed to an internal FTP server.  Could you be able to help me out?  Thanks!

Josh

Configure 506e for outside access to internal FTP server

Software firewalls, also known as host-based firewalls, provide a layer of software on one host that controls network traffic in and out of that single machine. Most operating systems now include firewall software, but many available software firewalls include central distribution, antivirus systems and disaster recovery.