Pix port 're-mapping' assistance

Posted on 2007-07-31
Last Modified: 2010-04-09

   We have a client who runs an application that comes through the firewall (Cisco Pix 506e) on port 4444.  It has been working for years with no issues until two of the local service providers blocked that port because of a blaster worm and now anyone on those two carriers cannot access the system.  This is a medical client who provides imaging to remote offices.

   We already tried to get the software vendor to change their listening port but that cannot happen.  We will need to make the Pix "re-map' so when you hit the outside IP address (statically mapped) on port 2222 it will 're-map' the incoming packets to port 4444, hit the server, and when the server sends the response back out to the internet and "re-maps" it back to port 2222 when it is delivered to the client.

   I'm pretty good with the basics on the Pix and cannot seem to get the commands correct on my test Pix box...

Question by:Sean_E_Smith
    LVL 29

    Expert Comment

    by:Alan Huseyin Kayahan
          Hi Sean_E_Smith
                  static(inside,outside) tcp outsidenatip 4444 insidenatip 2222 netmask 0 0
                  access-list outside_access_in permit tcp any host outsidenatip eq 4444

    LVL 79

    Expert Comment

    You have the static backwards, MrHusy...
    static (inside,outside) tcp outsideip 2222 insideip 4444 netmask 0 0
    access-list outside_access_in permit tcp any host outsideip eq 2222

    LVL 29

    Expert Comment

    by:Alan Huseyin Kayahan
         You are right Les. Thanks for correction.

    Author Comment

    Question here.

    I already have a static IP NAT mapping for the server since it does other things than just give out the images.  I could not put the commands in above because it already has that static mapping.  Here is what I have in my test pix right now (trying to get this working in the office before putting it into production)

    static (inside,outside) ICSDC1 netmask 0 0

    Hopefully this is just me being slow here....

    LVL 79

    Accepted Solution

    You have one option - and it's probably not what you want to hear.
    You need to map each and every port that you are using individually.
    no static (inside,outside) ICSDC1 netmask 0 0
    clear xlate
    static (inside,outside) tcp www ICSDC1 www netmask 0 0
    static (inside,outside) tcp ftp ICSDC1 ftp netmask 0 0
    static (inside,outside) tcp smtp ICSDC1 smtp netmask 0 0
    static (inside,outside) tcp 2222 ICSDC1 4444 netmask 0 0

    That is the ONLY way to remap an incomming tcp port to a different inside port

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    Router RV016 Cisco configuration 3 42
    AIM-CUE installation on router 2811 2 44
    Asa 5520 Configuration 3 53
    ASA in Multi-Context 1 33
    When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
    Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now