Solved

how i can forward some port to IP address (in pix 525)

Posted on 2007-03-23
4
329 Views
Last Modified: 2013-11-16
hi
how i can forward some port to IP address
i wnat to forword port 80,110,25 to ip 172.16.110.2 (and i want to use static nat)
is the below command true

X.X.X.X = public ip
static (inside,outside) X.X.X.X 172.16.110.2 netmask 255.255.255.255 0 0
access-list OutsideIn permit tcp any host X.X.X.X eq www                                                            
access-list OutsideIn permit tcp any host X.X.X.X eq smtp                                                            
access-list OutsideIn permit tcp any host X.X.X.X eq pop3      

thanks                                                




0
Comment
Question by:nasemabdullaa
  • 2
  • 2
4 Comments
 
LVL 28

Assisted Solution

by:batry_boy
batry_boy earned 125 total points
ID: 18780579
Do this:

static (inside,outside) tcp x.x.x.x www 172.16.110.2 www netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x smtp 172.16.110.2 smtp netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x pop3 172.16.110.2 pop3 netmask 255.255.255.255

Your access list statements look fine.  Remember to apply the access list to the interface:

access-group OutsideIn in interface outside

Hope this helps...
0
 

Author Comment

by:nasemabdullaa
ID: 18780672
hi
thanks for your reply
you mean the command must be like this

static (inside,outside) X.X.X.X 172.16.110.2 netmask 255.255.255.255 0 0
static (inside,outside) tcp x.x.x.x www 172.16.110.2 www netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x smtp 172.16.110.2 smtp netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x pop3 172.16.110.2 pop3 netmask 255.255.255.255
access-list OutsideIn permit tcp any host X.X.X.X eq www                                                            
access-list OutsideIn permit tcp any host X.X.X.X eq smtp                                                            
access-list OutsideIn permit tcp any host X.X.X.X eq pop3      
access-group OutsideIn in interface outside

is that true or not

thanks
0
 
LVL 28

Accepted Solution

by:
batry_boy earned 125 total points
ID: 18780739
Well, not exactly.

The first static in your above post:

static (inside,outside) X.X.X.X 172.16.110.2 netmask 255.255.255.255 0 0

would cause ALL ports to be forwarded from x.x.x.x to 172.16.110.2.  You stated in your initial question that you wanted to forward 3 ports (smtp, pop3, and www) to 172.16.110.2.  I thought you meant you wanted to use port redirection such that only those 3 ports would be forwarded to the internal host.  If what you meant is that you want to only ALLOW those 3 ports inbound, but translate ALL ports, then your first static is all you would need and you can get rid of the last 3 statics.  Does that make sense?

In other words, the following commands are pointless if the first static is also in there:

static (inside,outside) tcp x.x.x.x www 172.16.110.2 www netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x smtp 172.16.110.2 smtp netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x pop3 172.16.110.2 pop3 netmask 255.255.255.255

So, to do what you want you only need this one static:

static (inside,outside) X.X.X.X 172.16.110.2 netmask 255.255.255.255 0 0

or these 3 statics, but not both sets of commands:

static (inside,outside) tcp x.x.x.x www 172.16.110.2 www netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x smtp 172.16.110.2 smtp netmask 255.255.255.255
static (inside,outside) tcp x.x.x.x pop3 172.16.110.2 pop3 netmask 255.255.255.255

Having said this, you will still need the access list statements as they are.  Please let me know if I need to clarify.
0
 

Author Comment

by:nasemabdullaa
ID: 18780773
thanks
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now