PIX 501 port redirection

I have a PIX 501 at a customer site.  I am trying to do a port redirection for PC anywhere to server 192.168.201.  The current port redirection work fine to 192.168.0.4.  I've added the lines into the config that should have worked to redirect PC anywhere to 192.168.0.201.....but no joy.  Pls Help!!!
=============================================================

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxx.com.au
clock timezone EST 10
clock summer-time EDT recurring last Sun Oct 2:00 last Sun Mar 3:00
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
names
name 192.168.0.2 Server01
name 192.168.0.4 Server02
name 192.168.0.201 SCADA001
object-group service Peer2Peer tcp-udp
  description Blocks port ranges for Emule, Kazaa, Limewire, Morpheus
  port-object range 6346 6347
  port-object range 4661 4662
  port-object range 1214 1214
object-group service OutboundTraffic tcp-udp
  description Allowable Outbound ports
  port-object range 3389 3389
  port-object range 20 21
  port-object range 110 110
  port-object range 80 80
  port-object range 25 25
  port-object range 5900 5900
  port-object range 443 443
  port-object range 5631 5632
object-group service AllPorts tcp-udp
  port-object range 1 65535
object-group network WinServers
  network-object Server01 255.255.255.255
  network-object Server02 255.255.255.255
  network-object SCADA001 255.255.255.255
access-list outside_access_in permit tcp any host X.X.X.188 eq smtp
access-list outside_access_in permit tcp any host X.X.X.188 eq 3389
access-list outside_access_in permit tcp any host X.X.X.188 eq https
access-list outside_access_in permit tcp any host X.X.X.188 eq www
access-list outside_access_in permit tcp any host SCADA001 range pcanywhere-data
 5632
access-list outside_access_in permit udp any host SCADA001 range 5631 pcanywhere
-status
access-list inside_outbound_nat0_acl permit ip any 192.168.1.0 255.255.255.128
access-list inside_outbound_nat0_acl permit ip any 192.168.1.96 255.255.255.240
access-list inside_outbound_nat0_acl permit ip any 192.168.0.240 255.255.255.248

access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168
.0.240 255.255.255.248
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.0 255.255.255.128
access-list inside_access_in permit udp object-group WinServers any
access-list inside_access_in permit tcp any any object-group OutboundTraffic
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside X.X.X.186 255.255.255.248
ip address inside 192.168.0.1 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool dhcp_vpn 192.168.1.1-192.168.1.100
ip local pool pptp_pool2 192.168.0.241-192.168.0.245
pdm location Server01 255.255.255.255 inside
pdm location 192.168.1.96 255.255.255.240 outside
pdm location 192.168.0.240 255.255.255.248 outside
pdm location 192.168.1.0 255.255.255.128 outside
pdm location Server02 255.255.255.255 inside
pdm location SCADA001 255.255.255.255 inside
pdm group WinServers inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 X.X.X.187
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) Server01 Server01 netmask 255.255.255.255 0 0
static (inside,outside) X.X.X.188 Server02 netmask 255.255.255.255 0 0
static (inside,outside) tcp X.X.X.188 5631 SCADA001 5631 netmask 255.255.255.255 0 0
static (inside,outside) UDP X.X.X.188 5632 SCADA001 5632 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 X.X.X.185 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host Server01 hello timeout 10
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client configuration address respond
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet Server01 255.255.255.255 inside
telnet Server02 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
vpdn username administrator password *********
vpdn enable outside
vpdn enable inside
username admin password XXXXXXXXXXXX encrypted privilege 15
terminal width 80
: end
Benjovy1Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

batry_boyCommented:
You are trying to use the same external IP address for 192.168.0.201 as you are already using for 192.168.0.4.  You will need to choose a different public IP address for the "static" command that references 192.168.0.201 (SCADA001).  Also, you need to specify the public translated address for the destination in the "access-list" command rather than the private address.

So, for example, if x.x.x.189 were available and you decided to use it for translating 192.168.0.201, then you would put in the following commands:

static (inside,outside) tcp x.x.x.189 5631 SCADA001 5631 netmask 255.255.255.255
static (inside,outside) udp x.x.x.189 5632 SCADA001 5632 netmask 255.255.255.255
access-list outside_access_in permit tcp any host x.x.x.189 range pcanywhere-data 5632
access-list outside_access_in permit udp any host x.x.x.189 range 5631 pcanywhere-status

0
Benjovy1Author Commented:
I havent got any other public IP addresses available.  Is there any other solution?
0
batry_boyCommented:
Well, there is, but it will require that you reconfigure your existing translation for the .188 address such that you're not redirecting all ports inbound to IP address 192.168.0.4 (Server02) like you're currently doing.  I see that you are currently only allowing 4 ports inbound to x.x.x.188.  These are found in the following lines:

access-list outside_access_in permit tcp any host X.X.X.188 eq smtp
access-list outside_access_in permit tcp any host X.X.X.188 eq 3389
access-list outside_access_in permit tcp any host X.X.X.188 eq https
access-list outside_access_in permit tcp any host X.X.X.188 eq www

We'll need to reconfigure the existing "static" command that references the .188 and configure it for port redirection rather than it's current "one-to-one" static NAT configuration.  Here are the commands to do this:

no static (inside,outside) X.X.X.188 Server02 netmask 255.255.255.255
static (inside,outside) tcp X.X.X.188 smtp Server02 smtp netmask 255.255.255.255
static (inside,outside) tcp X.X.X.188 3389 Server02 3389 netmask 255.255.255.255
static (inside,outside) tcp X.X.X.188 https Server02 https netmask 255.255.255.255
static (inside,outside) tcp X.X.X.188 www Server02 www netmask 255.255.255.255
static (inside,outside) tcp x.x.x.188 5631 SCADA001 5631 netmask 255.255.255.255
static (inside,outside) udp x.x.x.188 5632 SCADA001 5632 netmask 255.255.255.255
access-list outside_access_in permit tcp any host x.x.x.188 range pcanywhere-data 5632
access-list outside_access_in permit udp any host x.x.x.188 range 5631 pcanywhere-status

The first "no static" removes the current one-to-one static NAT you have configured so that you can free up the individual ports for redirection in the subsequent lines.

The next four "static" commands configure port redirection for the 4 TCP ports you currently have allowed inbound from the Internet.

The next two "static" commands add the PC Anywhere ports for inbound redirection to a different internal server located at 192.168.0.201 (defined by name SCADA001).

The last two access-list commands allow the port ranges you specified in your original config.  Those may not be accurate since I thought that PC Anywhere only needed TCP 5631 and UDP 5632...you may be allowing more port opened up than is needed.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

Benjovy1Author Commented:
Thanks batry boy...
I'm doing this remotely...fingers crossed
Thanks again :)
0
Benjovy1Author Commented:
Thanks batry boy.  
I just had to run clear xlate & it worked.  Full points
0
batry_boyCommented:
Excellent...glad to help!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.