topic Re: PIX-501 NAT/ACL Problem in Network Security

PIX-501 NAT/ACL Problem

kooper390 — Mon, 11 Mar 2019 19:44:17 GMT

Hi all!

The Problem is, that in a remote location is a FAX-SIP-Adapter with his factory default address 192.168.2.1. I need to configure this device.

In the remote network has the address range 192.168.170.0/24.

Well, I tried to change the intern interface to the 192.168.2.0/24 network.

Ok everything is fine and I can ping the device.

Now I set some ACL and NAT rules

access-list WEB permit tcp any any
access-list WEB permit udp any any

access-group WEB in interface outside

static (inside,outside) tcp 170.230.30.18 www 192.168.2.1 www netmask 255.255.255.255 0 0

This is my config so far. But I get noch access to the webfrontend of the adapter.

If I used a SIP-Telefon webfrontend in the origin network (192.168.170.0/24), I get access from outside.

Is there any thing to consider?

I have here a PiX 501 with 6.3

Re: PIX-501 NAT/ACL Problem

Federico Coto Fajardo — Thu, 03 Feb 2011 13:28:15 GMT

Hi,

With the configuration that you mentioned you should be able to reach 192.168.2.1 on port 80 from outside by sending traffic to 170.230.30.18 on port 80.

You can confirm that the traffic is getting to the PIX by checking the hitcounts on the ACL show access-list WEB

If the IP 170.230.30.18 is not the outside IP of the PIX and is not being used anywhere else, you can change the static command for this one:

static (inside,outside) 170.230.30.18 192.168.2.1

Probably the problem is that you need to get traffic on other ports besides port 80 to the SIP device?

Federico.

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 13:43:56 GMT

Hi,

only for the initial configuration of the adapter I need access. Now I cannot test because they are working there.

Can I access the PIX further when I set static (inside,outside) 170.230.30.18 192.168.2.1

I can only access the PIX from outside.

kind regards

Re: PIX-501 NAT/ACL Problem

Federico Coto Fajardo — Thu, 03 Feb 2011 13:46:43 GMT

Gerit,

If you add static (inside,outside) 170.230.30.18 192.168.2.1 and 170.230.30.18 and 170.230.30.18 happens to be the outside IP of the PIX then you will lose access to the PIX. If the IP is used on other static rules, you might break those rules. Otherwise, there's no problem.

Federico.

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 16:28:36 GMT

Ok the ACL work

PIX# show access-list WEB
access-list WEB; 2 elements
access-list WEB line 1 permit tcp any any (hitcnt=10)
access-list WEB line 2 permit udp any any (hitcnt=0)

but I get no access to the web interface

Re: PIX-501 NAT/ACL Problem

Federico Coto Fajardo — Thu, 03 Feb 2011 17:31:30 GMT

Almost for sure the web traffic is being sent to the server.

Can you confirm the following:

1. If you log into the server, can you open a browser and get to the Internet?

I'm pretty sure that web traffic is being sent by the PIX to the server, so let's make sure the server is receiving it and replying back with the web page.

Federico.

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 17:44:44 GMT

hm and theres the problem.

In this net I have no other device for checking.

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 17:48:04 GMT

PIX#sh local-host

Interface inside: 5 active, 8 maximum active, 0 denied

local host: <192.168.2.1>,
    TCP connection count/limit = 1/unlimited
    TCP embryonic count = 1
    TCP intercept watermark = unlimited
    UDP connection count/limit = 0/unlimited
AAA:
Xlate(s):
    PAT Global (80) Local 192.168.2.1(80)
Conn(s):
    TCP out :18790 in 192.168.2.1:80 idle 0:00:55 Bytes 0 flags SaAB

Re: PIX-501 NAT/ACL Problem

Federico Coto Fajardo — Thu, 03 Feb 2011 17:50:50 GMT

Gerit,

Let's take it from here to try to fix the problem.

Please post the output of the ACL and static as you currently have it.

Federico.

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 17:53:04 GMT

PIX# sh access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 256)
alert-interval 300
access-list WEB; 2 elements
access-list WEB line 1 permit tcp any any (hitcnt=23)
access-list WEB line 2 permit udp any any (hitcnt=578)
PIX# sh static
static (inside,outside) tcp www 192.168.2.1 www netmask 255.255.255.255 0 0

Re: PIX-501 NAT/ACL Problem

kooper390 — Thu, 03 Feb 2011 17:56:24 GMT

and when I scan the outside (nmap) I get only 22 as open

Re: PIX-501 NAT/ACL Problem

kooper390 — Fri, 04 Feb 2011 15:23:21 GMT

Hi Federico

The adapter have no default GW ... ahm ... embarrassing ... so it could never work

thanks for support!

gerit