topic Re: minimum PIX config in Network Security

minimum PIX config

marcreiter — Fri, 21 Feb 2020 07:27:08 GMT

Sorry for the simple question but I am a simple person.

What is the minimum config for a pix

I have an access-l outbound permit ip any any - on the inside interface

and access-l inbound permit tcp any any eq 80 - for the outside

nat 1 0 0

global (outside) 1 interface

All I want available is the internet but I am getting a 300500 error "No translation group found "

Thanks for any help.

Re: minimum PIX config

pcomeaux — Tue, 08 Jun 2004 18:49:57 GMT

Maybe your NAT statement should read "nat (inside) 1 0 0" to specify the inside interface.

By default, you do not need any ACLs for traffic to flow from the inside to the outside.

You need a few things:

1) enable the interfaces

2) configure IP addresses on the interfaces

3) setup a default route

4) setup translation

You can always run "setup" while connected to the Pix's console port. After setting it up, you can then web into the Pix to finish the configuration.

Here's a link to the Establishing Connectivity Chapter of the Pix Documentation:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/bafwcfg.htm

peter

Re: minimum PIX config

marcreiter — Tue, 08 Jun 2004 19:05:17 GMT

OOOPS yea that is what it says. Nat (inside) 1 0 0

sorry for the typo.

Re: minimum PIX config

pcomeaux — Tue, 08 Jun 2004 19:45:51 GMT

Ok. Can you please post the results of the following commands so we can help you further:

1 - show ip

2 - show int or show interface (whichever works)

3 - show global

4 - show nat

5 - show route

6 - show access-group

7 - show access-list

My gut feeling is that the outside interface is still shutdown.

thanks

peter

Re: minimum PIX config

marcreiter — Tue, 08 Jun 2004 20:36:20 GMT

Your guts are a great tool.

interface ethernet0 "outside" is administratively down, line protocol is up

how do you administrativly start the interface?

Re: minimum PIX config

pcomeaux — Tue, 08 Jun 2004 20:48:05 GMT

Look for the line in the config that has "nameif interface 0 (or 1) auto shutdown" or something similar. Repeat the same command but without the "shutdown" keyword at the end and the interface should become active.

peter