topic Re: PIX515e ACL/routing issue in Network Security

PIX515e ACL/routing issue

cmuench — Mon, 11 Mar 2019 17:52:18 GMT

I am attempting to put in a new pix 515 into my network as a firewall.

Current layout is

en0 ip is 63.237.245.162-166 255.255.255.248

en1 ip is 10.1.1.254

Internal traffic ips are in range of 10.1.1.x with 255.255.255.0 subnet mask

When on the internal network I can't get to my static ips...

IE I open browser and type in 63.237.245.162

when on my internal network it times out

however anywhere else it pulls up just fine.

Re: PIX515e ACL/routing issue

Federico Coto Fajardo — Fri, 28 May 2010 20:25:12 GMT

Hi,

From the internal network you can reach the internal IPs and from the outside network you can reach the outside IPs.

This is the normal behavior.

Why do you want to access the public IPs from the internal network? Because of DNS resolution?

There are ways to be able to reach the outside IPs from the inside, please let us know what do you want to do.

Federico.

Re: PIX515e ACL/routing issue

cmuench — Fri, 28 May 2010 20:26:58 GMT

My problem is
mail.example.com -> 63.237.245.162

When people come onto the network they have to be able to resolve this name so that they can get email through outlook which is configured to use mail.example.com for when they are at home.

It resolves just fine through my DNS. Problem is the firewall

Re: PIX515e ACL/routing issue

Federico Coto Fajardo — Fri, 28 May 2010 20:31:51 GMT

Ok,

From the internal network you should be able to reach 63.237.245.162
So, you have a static like this:

static (in,out) 63.237.245.162 10.1.1.x

What's going to happen here is that the DNS reply will get to the machine with 63.237.245.162,
when that machine attempts to get to 63.237.245.162 it fails (because is on the outside of the Firewall).

One solution is this:

static (in,out) 63.237.245.162 10.1.1.x dns

Assuming that the DNS reply comes from the outside interface (you're using an external DNS)

The above command is going to translate not only the IP but the DNS reply as well, so that the internal
machine will actually go to 10.1.1.x when trying to reach the server.

Federico.

Re: PIX515e ACL/routing issue

cmuench — Fri, 28 May 2010 20:35:35 GMT

yes you are correct.

We have internal DNS however it doesn't resolve example.com

It has to go outside for that.

So your saying I have to create a static NAT rule for each public IP I want to get to?

But I'm using PAT(multiple public ip's to multiple internal servers and ports)

Isn't that going to interfere with it?

Re: PIX515e ACL/routing issue

Federico Coto Fajardo — Fri, 28 May 2010 20:39:42 GMT

You have a static like this correct?

static (in,out) 63.237.245.162 10.1.1.x

This means that you host an internal server with real IP 10.1.1.x and NAT IP 63.237.245.162

In order to be able to reach the public IPs behind the ASA, yes you need a static NAT for this (don't confuse when going to public IPs on the Internet, you don't need a static NAT for that, only PAT).

You require a static NAT to allow incoming requests to your internal servers.

PAT and static will not interfere with each other because the static NAT takes precedence.

If you want to see the details, please post the output of the:

sh run static

sh run nat

sh run global

Federico.

Re: PIX515e ACL/routing issue

cmuench — Fri, 28 May 2010 21:41:52 GMT

I have the following

static (inside,outside) tcp 63.237.245.162 https 10.1.1.22 https netmask 255.255.255.255

Re: PIX515e ACL/routing issue

Federico Coto Fajardo — Fri, 28 May 2010 22:15:38 GMT

Substitute:

static (inside,outside) tcp 63.237.245.162 https 10.1.1.22 https netmask 255.255.255.255

For

static (inside,outside) tcp 63.237.245.162 https 10.1.1.22 https netmask 255.255.255.255 dns

Federico.

Re: PIX515e ACL/routing issue

cmuench — Fri, 28 May 2010 22:58:12 GMT

I added that line however now instead of taking awhile to time out its immediate.

Any other ideas?

Re: PIX515e ACL/routing issue

Federico Coto Fajardo — Sat, 29 May 2010 07:38:15 GMT

The purpose of adding the line:

static (inside,outside) tcp 63.237.245.162 https 10.1.1.22 https netmask 255.255.255.255 dns

is so that from the inside network when you do a DNS lookup for mail.example.com you will still get the public IP, but when the reply comes to your machine, you will be able to get to the server using its private IP.

Are you trying from an inside machine to go to mail.example.com?

Federico.