PIX 501 STATIC NAT

ck459
Thanks for the help. I will try your suggestions as soon as i get to work.

ck459
error msg when i enter access-list statement

ERROR:<extended> not a valid permission

Hi Skip,
Try without the extended keyword. I don't know what code you are running on the PIX, but that keyword in the ACL apparently is not supported in your version.
Not sure if the Access list on the static will work. What PIXOS version do you have?

version is 6.3(4)
will try without extended keyword now

hi ck459

the commands were accepted but still not working the way i want it to. I made some changes so it would be a little easier for us to troubleshoot. I now have two hosts behind the firewall (10.145.35.2 and 10.145.35.3) I have one host on the outside of the firewall (10.20.157.101). I connected to the PIX with a Cisco VPN client from the outside. That gave me an IP of 192.168.66.250 on the host outside the PIX. I then changed your commands to:

access-list host2 permit ip host 10.145.35.2 192.168.66.2 255.255.255.255
access-list host3 permit ip host 10.145.35.3 192.168.66.3 255.255.255.255
 
static (inside,outside) 192.168.66.2 access-list host2
static (inside,outside) 192.168.66.3 access-list host3

I can ping 10.145.35.2 and 10.145.35.3 from the outside but i cannot ping 192.168.66.2 or 192.168.66.3

any ideas ?

All right, but why did you change the subnet in the access list from :
access-list host2 extended permit ip host 10.145.35.2 192.168.66.248 255.255.255.248
to
 access-list host2 permit ip host 10.145.35.2 192.168.66.2 255.255.255.255
?
The ip rage in the access-list needs to be the range you are assigning to the VPN clients.

I tried to make it easier by just natting the two ip addresses together instead of a range. should i change it back?

here is the current running config
pixfirewall# sh running
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip any 192.168.66.248 255.255.255.24
8
access-list inside_outbound_nat0_acl permit ip 10.145.35.0 255.255.255.0 192.168
.66.248 255.255.255.248
access-list outside_cryptomap_dyn_20 permit ip any 192.168.66.248 255.255.255.24
8
access-list outside_cryptomap_dyn_40 permit ip any 192.168.66.248 255.255.255.24
8
access-list host2 permit ip host 10.145.35.2 host 192.168.66.2
access-list host3 permit ip host 10.145.35.3 host 192.168.66.3
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 10.20.157.2 255.255.255.0
ip address inside 10.145.35.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool backsPOOL 192.168.66.250-192.168.66.255
pdm location 192.168.66.248 255.255.255.248 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 192.168.66.2 access-list host2 0 0
static (inside,outside) 192.168.66.3 access-list host3 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.20.157.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 10.145.35.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup backs address-pool backsPOOL
vpngroup backs idle-time 1800
vpngroup backs password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 60
ssh timeout 5
console timeout 0
dhcpd address 10.145.35.2-10.145.35.129 inside
dhcpd dns 10.10.157.82
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:24b7ec20ed3f02301deb3d83fdb8b280
: end

hope this helps
will not change anything else unless you instruct me to
Skiip

i changed the access-list commands back to:

access-list host2 permit ip host 10.145.35.2 192.168.66.248 255.255.255.248
access-list host3 permit ip host 10.145.35.3 192.168.66.248 255.255.255.248

still able to ping 10.145.35.2 but not 192.168.66.2

sorry about venturing out on my own. You gave me a little confidence so i thouoght i knew what i was doing...I should have known better.

try removing this line now :
nat (inside) 0 access-list inside_outbound_nat0_acl

At that point, you should not be able to ping the 10 145 anymore, but the static should now work for the 192 addresses
 

thank you
thank you

this is the first time i used experts-exchange. I think i will hnaging around here quite a bit. Hope I am as much help to someone someday as you were to me....thanks again

You're welcome, glad I could help you :-)