Solved

Port forward from Interface PAT on Cisco PIX 506E to internal IP

Posted on 2009-05-05
2
638 Views
Last Modified: 2012-05-06
We are running a Cisco PIX 506E and need to forward port 1010 to a device internally. We already have 1 port forwarded on the Interface IP which I think is part of my problem.  I'm fairly familiar with the PDM, but it won't let me forward a port without first creating a NAT rule with one of our external IP's. I tried to assign the internal device the IP of the interface but the forward does not appear to work after that.

I've posted a sample of some of the show run, the one I'm trying to get to work is the SERVER entry.

access-list outside_access_in permit tcp any host SERVER eq 1010

Any suggestions on how to set this up would be great. The more info the better on the configuration as I'm not an expert with the CLI.

Thanks!
access-list outside_access_in permit udp any host d.d.d.8 eq nameserver

access-list outside_access_in permit tcp any host a.a.a.5 eq 3389

access-list outside_access_in permit tcp any host b.b.b.6 eq smtp

access-list outside_access_in permit tcp any host b.b.b.6 eq pop3

access-list outside_access_in permit tcp any host b.b.b.6 eq www

access-list outside_access_in permit tcp any host b.b.b.6 eq https

access-list outside_access_in permit udp any host b.b.b.6 eq nameserver

access-list outside_access_in permit tcp any host c.c.c.7 eq 3389

access-list outside_access_in permit tcp any host c.c.c.7 eq www

access-list outside_access_in permit tcp any host c.c.c.7 eq https

access-list outside_access_in permit tcp any host SERVER eq 1010
 

ip address outside z.z.z.4 255.255.255.248
 

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 0 SERVER 255.255.255.255 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) a.a.a.5 Term_Serv netmask 255.255.255.255 0

0

static (inside,outside) b.b.b.6 Email netmask 255.255.255.255 0 0

static (inside,outside) c.c.c.7 XXXPACS netmask 255.255.255.255 0 0

static (inside,outside) d.d.d.8 XXX_DC netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

Open in new window

0
Comment
Question by:K6465
2 Comments
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 24306663
This should do it:

static (inside,outside) tcp interface 1010 <inside ip> 1010 netmask 255.255.255.255

access-list outside_access_in permit tcp any interface outside eq 1010
0
 

Author Comment

by:K6465
ID: 24316439
JFrederick, I will give that a shot here in an hour or two and let you know how it goes. Thanks!
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now