Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 507
  • Last Modified:

How do I configure static to the second network on Pix

I have a pix with two networks behind, the first network is working correctly with the statics and the access list. I tried to add a static to a server on the second network but it did not work.

Pix:
Inside: 192.168.100.0/24

Router between the two networks:
Inside: 192.168.10.0/24
Outside: 192.168.100.0/24

I can ping/access the both networks from one to eachother.

Can help how can I do the configuration?
0
arefone
Asked:
arefone
1 Solution
 
jmeggersSr. Network and Security EngineerCommented:
route Inside 192.168.10.0 255.255.255.0 192.168.100.x (router's outside IP address)
0
 
arefoneAuthor Commented:
It is already added on the pix.
0
 
jmeggersSr. Network and Security EngineerCommented:
Sorry, I was thinking static route, not static NAT.  

So you have a static NAT statement with appropriate ACL entries in place and it's not working?  Can you post the static and relevant ACL statements so we can review them?  Is routing working properly, meaning does the server have a default gateway pointing back to the intermediate router, and does that router have a default pointing back to the PIX?

Can you be more specific with what specifically is not working?  What does "show xlate" show? If traffic comes in from the outside, can you tell whether the ASA is forwarding it appropriately?  Might be helpful to set up Wireshark to capture some traffic so you can see what's happening outside of the ASA.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
arefoneAuthor Commented:
ON PIX:
access-list 110 permit tcp any host server eq www
access-list 110 permit tcp any host server eq ssh
static (inside,outside) tcp server ssh 192.168.10.240 ssh netmask 255.255.255.255 0 0
static (inside,outside) tcp server www 192.168.10.240 www netmask 255.255.255.255 0 0


ON ROUTE:
ip nat inside source list main interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 192.168.100.181
!
ip access-list extended main
 deny   ip 192.168.10.0 0.0.0.255 192.168.100.0 0.0.0.255
 permit ip 192.168.10.0 0.0.0.255 any

The routing is working good, on my opinion the return through traffic it is not working, I mean from the router to the pix.

Maybe I have to set something else on the router?
0
 
arefoneAuthor Commented:
This is the result of debuggin ip nat on the router:

Apr 19 18:11:37.616: NAT: s=93.40.133.84, d=192.168.100.182->192.168.10.240 [6522]
Apr 19 18:11:43.744: NAT: s=192.168.10.240->192.168.100.182, d=93.40.133.84 [57204]
0
 
lrmooreCommented:
> deny   ip 192.168.10.0 0.0.0.255 192.168.100.0 0.0.0.255
You have to loosen this up so these hosts can talk directly to the PIX

>ip route 0.0.0.0 0.0.0.0 192.168.100.181
I'm assuming this is the PIX inside interface?

Do you have a route on the PIX pointing to the Router?
  route inside 192.168.10.0 255.255.255.0 192.168.100.??

>ip nat inside source list main interface FastEthernet4 overload
Are you natting that traffic on the router before it hits the PIX?
0
 
arefoneAuthor Commented:
Hi Irmoore,

1. I added it to let hosts in the both two networks to talk together.
2. the 192.168.100.181 it the inside interface of the gateway router, is another router we use is as gatway.
3. yes I have, route inside 192.168.10.0 255.255.255.0 192.168.100.181
4. I used the command "ip nat inside source list ........." to permit hosts go to internet.

I am not expert, so please ask me again the things in case I did not answer as you expected.
0
 
Mystique_87Commented:
Hi arefone,

I am not sure what version of pix you are using. In case it is above 7.2(1), please try the this command:

packet-tracer in <interface_name> tcp <source ip> 5555 <destination ip> <80/ssh>

This will simulate the packet from the 'interface_name with <source ip> to the <destination ip>.

Please post the output.
0
 
Feroz AhmedSenior Network EngineerCommented:
Pix:
Inside: 192.168.100.0/24

Router between the two networks:
Inside: 192.168.10.0/24
Outside: 192.168.100.0/24

Hi,
Your question is wrong and there is no static configured on your Pix and where is the 2nd router ip address it is not given you have just configured inside network on pix and inside router where is outside router and outside pix configuration to configure static nat on pix.
0
 
arefoneAuthor Commented:
Hi all,

I solved the problem simply taking off the "ip nat inside source list main interface FastEthernet4 overload" from the router between the network 192.168.100.0/24 and the network 192.168.10.0/24.

I will give the points to Irmoore because he reported that question of the natting command as it should not be, in fact, it should not be, and taking it off every thing is working good now.

Thanks for all of you
0
 
arefoneAuthor Commented:
The problem was solved taking off the "ip nat inside source list main interface FastEthernet4 overload" command from the router between the two networks.
0

Featured Post

Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

Tackle projects and never again get stuck behind a technical roadblock.
Join Now