PIX Newbie - how to set up 501

Posted on 2007-07-20
Last Modified: 2013-11-30
Have PIX 501.
Need to set it to static IP, internal interface to 192... Only one internal machine to be routed to.
Need to set up ACLs to allow for PC Anywhere, outgoing mail, web browsing and ftp.
How do I do it, or where is a good source to find out?

Scenario - restaurant.
broadband modem comes into Pix.
Pix set for external static IP
Pix connects to switch.
Manager's PC, and other terminals connect to same switch.
PC needs to send email from internal smtp server, collect from POP3 server.
Need to ftp outbound
Need to operate as PC Anywhere Host

Question by:bparkbpark
    LVL 25

    Expert Comment

    ip address outside w.x.y.z  <--set ip and mask to your assigned ones
    ip address inside
    global (outside) 1 interface  <-- may give warning as it actually should exist already
    nat (inside) 1 0 0        <-- may give warning as it actually should exist already
    static (inside,outside) tcp interface <<pc anywhere port>> <<private ip of pc anywhere host>> <<pc anywhere port>>
    static (inside,outside) tcp interface 25 <<private ip of mail server>> 25
    access-list outside-in permit tcp any interface outside eq <<pc anywhere port>>
    access-list outside-in permit tcp any interface outside eq smtp
    access-group outside-in interface outside
    access-list inside-in permit tcp host <<mail server ip>> any eq smtp
    access-list inside-in deny tcp any any eq smtp
    access-list inside-in permit tcp any any eq 21
    access-list inside-in permit tcp any any eq 80
    access-list inside-in permit tcp any any eq 443
    access-list inside-in permit udp any any eq 53
    fixup protocol ftp 21
    no fixup protocol smtp 25

    that will allow your mail server to send email and block others from doing so (protects your IP from being blacklisted by any potentially infected hosts mass mailing out).  allows dns lookups, ftp and web and blocks all other outgoing traffic.  allows pc anywhere to host you need and smtp to mail server and blocks everything else coming in.  let me know if i missed anything
    LVL 79

    Expert Comment

    Cyclops - in your inside-in acl you forgot to allow PCA out, and isn't there 2 ports one TCP and one UDP for PCA?
    LVL 25

    Expert Comment

    I'm actually not familiar with PC Anywhere as I've never even seen it in use or looked into it; just know what it does.  I guess I assumed it worked like RDP or VNC where you just allow the one port in and your good.
    Do you really have to allow a port out for PCA?  Again I'm not familiar with it so assumed that the pix would allow the return traffic after the acl allowed the syn and the xlate entry was created.
    LVL 79

    Accepted Solution

    >Do you really have to allow a port out for PCA?
    Only if you are creating a list to restrict outbound as you were demonstrating above.

    PCA does use two ports TCP/5631 and UDP/5632
    LVL 25

    Assisted Solution

    you're right, you need two port but only on the outside-in acl, nothing more on the inside-in acl and after that the conn table takes care of things. or am i missing something.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Like many organizations, your foray into cloud computing may have started with an ancillary or security service, like email spam and virus protection. For some, the first or second step into the cloud was moving email off-premise. For others, a clou…
    I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
    How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now