topic A pix port redirection question in Network Security

A pix port redirection question

xbw — Fri, 21 Feb 2020 08:27:04 GMT

I have only one public ip address.It was used by outside interface.How can I allow outside host to access to internal

web server?

Re: A pix port redirection question

itchampnz — Sun, 09 Oct 2005 01:08:56 GMT

Hi, you have 2 options.

If you can use that public ip for just the webserver and nothing else then a standard static would do.

However if you want to prepare for expansion later, you would need to utilise port forwarding, so you would set it up to forward any port 80 traffic to the privately addressed inside ip address. This is by far the recommended way.

See here for details.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml

Re: A pix port redirection question

jackko — Sun, 09 Oct 2005 02:15:46 GMT

one way is to configure port forwarding on the pix.

e.g.

static (inside,outside) tcp 80 80 netmask 255.255.255.255 0 0

access-list 100 permit tcp any host eq 80

access-group 100 in interface outside

clear xlate

the last command "clear xlate" is used to force the pix to refresh the existing address translation, so that the new static statement will be kicked off.

Re: A pix port redirection question

jmia — Sun, 09 Oct 2005 09:09:15 GMT

As per Jack Ko's post, you could also use keyword: interface on your static i.e. if you only have one public IP and this IP is being used for the PIX outside interface:

static (inside,outside) tcp interface 80 80 netmask 255.255.255.255 0 0

-or-

For SMTP access:

access-list 100 permit tcp any host eq smtp

access-group 100 in interface outside

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Again, save with: write mem and also issue: clear xlate

Hope this helps,

Jay

Re: A pix port redirection question

bobfuller — Thu, 01 Dec 2005 08:56:45 GMT

I've been trying to do a similar port forward, however have been unsuccessful. My outside address is obtained from my ISP's dhcp and is not static. This is from a cable modem connection, residential service.

I'm trying to effectively do what standard home retail routers like Linksys or any others do.

Is this possible over a DHCP'd single address service?

TIA,

Bob