topic Re: Replacing Alias Statements in Network Security

Replacing Alias Statements

rsinghnyc — Mon, 11 Mar 2019 09:02:28 GMT

Greetings,

I have a PIX515 with 6.3(5). I am trying to convert some Alias Statements, original input by a former employee, and need some guidance to convert to Static Statements.

Here are a couple:

alias (inside) 10.xxx.xx.x 2xx.2xx.xx.xx 255.255.255.255

alias (inside) 2xx.2xx.xx.x 172.xxx.xxx.x 255.255.255.255

alias (dmz) 172.xxx.xxx.x 2xx.2xx.xxx.xx 255.255.255.255

Is this the proper syntax for the corresponding statements above?:

Static (inside,outside)2xx.2xx.xx.xx 10.100.xx.x netmask 255.255.255.255 0 0

Static (inside,outside)https 172.xxx.xxx.x tcp 2xx.2xx.xx.x netmask 255.255.255.255 0 0

static (dmz,outside) tcp 2xx.2xx.xx.xx https 172.xx.xx.x https netmask 255.255.255.255 0 0

Re: Replacing Alias Statements

jgervia_2 — Wed, 29 Nov 2006 22:07:35 GMT

Hello,

You can't really tell from the alias statements where those networks are.

I'm assuming that the 10.x network is on the inside interface, the 172.x network is on the dmz. is the 2xx on the outside?

--Jason

Re: Replacing Alias Statements

rsinghnyc — Thu, 30 Nov 2006 12:27:24 GMT

Jason,

Yes the 10.x network is on the inside, the 172.x is in the DMZ, and the 2xx. is the outside.

Robert

Re: Replacing Alias Statements

jgervia_2 — Thu, 30 Nov 2006 14:14:21 GMT

Ok,

Assuming these alias statements are correct:

-------------------

alias (inside) 10.xxx.xx.x 2xx.2xx.xx.xx 255.255.255.255

should be

static (inside,outside)2xx.2xx.xx.xx 10.xxx.xx.x netmask 255.255.255.255

-------------------

alias (inside) 2xx.2xx.xx.x 172.xxx.xxx.x 255.255.255.255

This one is interesting. 2xx.2xx.xx.x is not an inside IP address. if we went strictly by the alias syntax it would be:

static (inside, dmz) 172.xxx.xxx.x 2xx.2xx.xx.x netmask 255.255.255.255

the other possibility is that the DMZ address is the real address and it's mapped to the inside as the 2xx.

Though the 2xx.xxx address isn't on the inside interface. You might want to keep an eye on this one.

the other possibility is that the DMZ address is the real address and it's mapped to the inside as the 2xx.

so it would be

static (dmz,inside) 2xx.2xx.xx.x 172.xxx.xxx.x netmask 255.255.255.255

So anyone initiating to that external address would go to the dmz.

---------------------

alias (dmz) 172.xxx.xxx.x 2xx.2xx.xxx.xx 255.255.255.255

should be

static (dmz,outside) 2xx.2xx.xxx.xx 172.xxx.xxx.x netmask 255.255.255.255

---------------------

Re: Replacing Alias Statements

rsinghnyc — Thu, 30 Nov 2006 19:33:34 GMT

Jason,

This was very helpful. Thanks.

Robert

Re: Replacing Alias Statements

jgervia_2 — Thu, 30 Nov 2006 21:18:12 GMT

Don't forget to rate if it works. 🙂

--jason