Save 30% on the CV211 using promo code EXPERTS30 now through April 30th. The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.
Course Of The Month
2 days, left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Static route with port range
Posted on 2011-03-15
I am trying to create a static map from the outside to the inside with a port range on a Cisco 515e. I have created and saved the access-list below. However, the static route continues to receive an error stating Invalid Global Port Range . I have found some solutions but they are clear as mud. From what i can understand, the pix can not do statics with port ranges. Any ideas and I remember now why I haven't used Cisco in years.
Here are the commands:
static (inside,outside) tcp XX.XX.182.213 range 6400 8191 XXX.XXX.0.206 range 6400 8191 netmask 255.255.255.255 0 0
Here are the commands:
static (inside,outside) tcp XX.XX.182.213 range 6400 8191 XXX.XXX.0.206 range 6400 8191 netmask 255.255.255.255 0 0
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
3
3-
2
- +2
12 Comments
Active today
Maybe it's just semantics, but I suspect you understand this is not a static route, it's a static NAT statement.
Not sure you can do what you're trying to with a port range. I've only ever done it with a single port, like translating 80 to 8080, or something similar.
Not sure you can do what you're trying to with a port range. I've only ever done it with a single port, like translating 80 to 8080, or something similar.
I am afraid that isn't going to work for a static. You can only use a port range in access lists. You'll have to create every static separately :-~
Sorry for the bad news.
Sorry for the bad news.
Hi there,
You can make a static nat rule and that covers all ports. You can also make a static pat rule, but you have to make one for each port you want to open. Beware of doing this though, as each static pat translation will consume some memory on your PIX... if you have to many it will crash because your memory will fill up. Here's a doc on how to setup PAT rules.
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_staticpat.html
These commands also work with PIXes.
Cheers!
You can make a static nat rule and that covers all ports. You can also make a static pat rule, but you have to make one for each port you want to open. Beware of doing this though, as each static pat translation will consume some memory on your PIX... if you have to many it will crash because your memory will fill up. Here's a doc on how to setup PAT rules.
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_staticpat.html
These commands also work with PIXes.
Cheers!
pugglewuggle, thanks for the link and i have read over but was able to locate anything regarding port ranges
so where it says the protocol tcp or udp, after that it says a port... Sometimes it's a word such as smtp or http. When you need to make a port range you have to make a separate static statement for every port. It's not very fun but that's how it works. Access lists allow ranges to be opened in the firewall, but statics must be specified one by one. Again, be carefil to watch your ram if you add large numbers of statics... Hundreds or thousands can fill your memory up and crash the box. I've done that before by accident. Make sure you leave 10-15% free.
Cheers!
Cheers!
What Pugglewuggle is saying is that if you have more than one public address you can use one of them to do a 1-on-1 static. That way the public address is (exclusively) linked to the XXX.XXX.0.206 address (one on one) so you don't have to create a static for every port you want to forward through the static. You then define the ports you want to pass through in your access list, in which you can use port ranges.
But that only works if you have more than one public address available........
But that only works if you have more than one public address available........
Featured Post
Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
WARNING:
If you follow the instructions here, you will wipe out your VTP and VLAN configurations. Make sure you have backed up your switch!!!
I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses
Course of the Month2 days, left to enroll
717 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.