Pix 506 Web, Mail Config w/one IP

rcollings — Fri, 21 Feb 2020 08:44:22 GMT

Greetings, I'm trying to configure my Pix 506 to allow all outbound traffic and forward incoming port 25,80, 8080 and 7777 traffic to an internal web servers (192.168.1.3,4) and mail server (192.168.1.2)

I have one external IP x.x.x.12

What am I missing...

Thanks. --rob

Here is my config:

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

names

name 192.168.1.4 NVDEV02

name 192.168.1.3 NVAPP01

access-list NVEGVPN_splitTunnelAcl permit ip any any

access-list inside_outbound_nat0_acl permit ip any 192.168.1.0 255.255.255.192

access-list inside_outbound_nat0_acl permit ip any interface outside

access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.0 255.255.255.192

access-list outside_cryptomap_dyn_20 permit ip any interface outside

access-list outside_access_in permit tcp any host x.x.x.12 eq 8080

access-list outside_access_in permit tcp any host x.x.x.12 eq www

access-list outside_access_in permit tcp any host x.x.x.12 eq 7777

access-list outside_access_in permit tcp any host x.x.x.12 eq smtp

pager lines 24

logging on

logging console informational

logging trap informational

mtu outside 1500

mtu inside 1500

ip address outside x.x.x.12 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool NVEGPOOL 192.168.1.30-192.168.1.49

pdm location 192.168.1.2 255.255.255.255 inside

pdm location NVAPP01 255.255.255.255 inside

pdm location NVDEV02 255.255.255.255 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp x.x.x.12 www NVAPP01 www netmask 255.255.255.255 0 0

static (inside,outside) tcp x.x.x.12 7777 NVAPP01 7777 netmask 255.255.255.255 0 0

static (inside,outside) tcp x.x.x.12 8080 NVDEV02 8080 netmask 255.255.255.255 0 0

static (inside,outside) tcp x.x.x.12 smtp 192.168.1.2 smtp netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.12 1

route inside 192.168.1.2 255.255.255.255 192.168.1.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server RADIUS (inside) host 192.168.1.2 nvegvpn timeout 5

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

Re: Pix 506 Web, Mail Config w/one IP

Patrick Iseli — Mon, 27 Feb 2006 15:24:24 GMT

Config looks good. Do you have done a < clear xlate > ?

Take care this will reset the whole translation table and all users will loose your sessions.

sincerely

Patrick

Re: Pix 506 Web, Mail Config w/one IP

rcollings — Mon, 27 Feb 2006 16:12:27 GMT

Thanks Patrick. That was it. A rookie mistake on my part!!!

topic Re: Pix 506 Web, Mail Config w/one IP in Network Security

Pix 506 Web, Mail Config w/one IP

Re: Pix 506 Web, Mail Config w/one IP

Re: Pix 506 Web, Mail Config w/one IP