We help IT Professionals succeed at work.

How do I configure static to the second network on Pix

arefone
arefone asked
on
520 Views
Last Modified: 2012-05-11
I have a pix with two networks behind, the first network is working correctly with the statics and the access list. I tried to add a static to a server on the second network but it did not work.

Pix:
Inside: 192.168.100.0/24

Router between the two networks:
Inside: 192.168.10.0/24
Outside: 192.168.100.0/24

I can ping/access the both networks from one to eachother.

Can help how can I do the configuration?
Comment
Watch Question

John MeggersNetwork Architect

Commented:
route Inside 192.168.10.0 255.255.255.0 192.168.100.x (router's outside IP address)

Author

Commented:
It is already added on the pix.
John MeggersNetwork Architect

Commented:
Sorry, I was thinking static route, not static NAT.  

So you have a static NAT statement with appropriate ACL entries in place and it's not working?  Can you post the static and relevant ACL statements so we can review them?  Is routing working properly, meaning does the server have a default gateway pointing back to the intermediate router, and does that router have a default pointing back to the PIX?

Can you be more specific with what specifically is not working?  What does "show xlate" show? If traffic comes in from the outside, can you tell whether the ASA is forwarding it appropriately?  Might be helpful to set up Wireshark to capture some traffic so you can see what's happening outside of the ASA.

Author

Commented:
ON PIX:
access-list 110 permit tcp any host server eq www
access-list 110 permit tcp any host server eq ssh
static (inside,outside) tcp server ssh 192.168.10.240 ssh netmask 255.255.255.255 0 0
static (inside,outside) tcp server www 192.168.10.240 www netmask 255.255.255.255 0 0


ON ROUTE:
ip nat inside source list main interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 192.168.100.181
!
ip access-list extended main
 deny   ip 192.168.10.0 0.0.0.255 192.168.100.0 0.0.0.255
 permit ip 192.168.10.0 0.0.0.255 any

The routing is working good, on my opinion the return through traffic it is not working, I mean from the router to the pix.

Maybe I have to set something else on the router?

Author

Commented:
This is the result of debuggin ip nat on the router:

Apr 19 18:11:37.616: NAT: s=93.40.133.84, d=192.168.100.182->192.168.10.240 [6522]
Apr 19 18:11:43.744: NAT: s=192.168.10.240->192.168.100.182, d=93.40.133.84 [57204]
Sr. Systems Engineer
CERTIFIED EXPERT
Top Expert 2008
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Hi Irmoore,

1. I added it to let hosts in the both two networks to talk together.
2. the 192.168.100.181 it the inside interface of the gateway router, is another router we use is as gatway.
3. yes I have, route inside 192.168.10.0 255.255.255.0 192.168.100.181
4. I used the command "ip nat inside source list ........." to permit hosts go to internet.

I am not expert, so please ask me again the things in case I did not answer as you expected.
Hi arefone,

I am not sure what version of pix you are using. In case it is above 7.2(1), please try the this command:

packet-tracer in <interface_name> tcp <source ip> 5555 <destination ip> <80/ssh>

This will simulate the packet from the 'interface_name with <source ip> to the <destination ip>.

Please post the output.
Feroz AhmedSenior Network Security  / Senior System Engineer
CERTIFIED EXPERT

Commented:
Pix:
Inside: 192.168.100.0/24

Router between the two networks:
Inside: 192.168.10.0/24
Outside: 192.168.100.0/24

Hi,
Your question is wrong and there is no static configured on your Pix and where is the 2nd router ip address it is not given you have just configured inside network on pix and inside router where is outside router and outside pix configuration to configure static nat on pix.

Author

Commented:
Hi all,

I solved the problem simply taking off the "ip nat inside source list main interface FastEthernet4 overload" from the router between the network 192.168.100.0/24 and the network 192.168.10.0/24.

I will give the points to Irmoore because he reported that question of the natting command as it should not be, in fact, it should not be, and taking it off every thing is working good now.

Thanks for all of you

Author

Commented:
The problem was solved taking off the "ip nat inside source list main interface FastEthernet4 overload" command from the router between the two networks.
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.