topic Re: Forwarding incoming udp traffic to a specific internal addre in Network Security

Forwarding incoming udp traffic to a specific internal address on PIX

dmepix — Fri, 21 Feb 2020 06:45:11 GMT

My question is: How to forward udp port 3283 to a single internal ip address on the PIX 515? This is to allow an internal client to connect to an Apple X-Serve via Apple Remote Desktop.

Re: Forwarding incoming udp traffic to a specific internal addre

mostiguy — Tue, 20 May 2003 15:06:49 GMT

It depends. Are you using nat, or not?

Post your whole config, minus the password lines.

Re: Forwarding incoming udp traffic to a specific internal addre

dmepix — Tue, 20 May 2003 19:24:14 GMT

Yes I am using nat. I figured there was a command set I wasn't aware of.

Which part of the config would you like to see? I'm required to keep part of it confidential.

Re: Forwarding incoming udp traffic to a specific internal addre

mhoda — Tue, 20 May 2003 20:36:17 GMT

Hi,

Do you have a public ip address to translate to Apple X-Serve? If so, here is what you can configure:

static (inside, outside) External_IP Internal_IP

If you don't have any public routable ip then, you can use the outside interface ip address of the PIX to configure port redirection.

static (inside,outside) udp interface 3283 Internal_IP 3283

You need to allow the traffic from outside to inside as follows:

access-list 101 permit udp any host interface_ip/public_ip eq 3283

Then apply it to the outside interface of PIX:

access-group 101 in interface outside

Please let me know if you have any question. Thanks,

Mynul

Re: Forwarding incoming udp traffic to a specific internal addre

mhoda — Tue, 20 May 2003 20:37:52 GMT

Please refer to the following link for more details:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml#topic9

Thanks,

Mynul

Re: Forwarding incoming udp traffic to a specific internal addre

dmepix — Wed, 21 May 2003 16:47:29 GMT

The static command is exactly what I needed to see. It works now. The documentaiton also proved to be a very good resource. Thank you for your help.