topic Re: IP to IP static NAT in Network Security

IP to IP static NAT

omar.elmohri — Mon, 11 Mar 2019 15:49:20 GMT

With PIX 6.3

I'm using a static IP-to-IP translation also ACL permission, and I'm unable to access to the inside.

What's may be wrong?

Regards,

Omar

Re: IP to IP static NAT

andrew.prince — Tue, 30 Jun 2009 07:58:19 GMT

Your acl could be using the wrong destination address, you could be using the wrong internal address - check both of these.

HTH>

Re: IP to IP static NAT

omar.elmohri — Tue, 30 Jun 2009 08:00:36 GMT

The ACL is recording matches!! and the Static translation is fine.

Re: IP to IP static NAT

andrew.prince — Tue, 30 Jun 2009 08:03:27 GMT

Then you need to check if the internal device is actually listening on the UDP/TCP port numbers you have defined in your ACL.

Also if the internal device has internet access - goto www.whatismyip.com and confirm the NAT translation is 100% correct.

Re: IP to IP static NAT

omar.elmohri — Tue, 30 Jun 2009 08:08:26 GMT

When using the 'show xlate' that don't show details on that PIX edition, is there a way for that?

Re: IP to IP static NAT

andrew.prince — Tue, 30 Jun 2009 08:14:23 GMT

AFAIK - there is not much, see the below command reference:-

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/s.html#wp1084248

Re: IP to IP static NAT

omar.elmohri — Tue, 30 Jun 2009 08:19:44 GMT

I'll try to review all that points and give a feedback.

Re: IP to IP static NAT

omar.elmohri — Tue, 30 Jun 2009 09:47:20 GMT

Here is more details about the situation:

Fisrt, I have the commandes:

ACL:

permit tcp any 'public@ip1' eq www

permit ip any 'public@ip2

NAT:

static (inside,outside) tcp public@ip1 www private@ip1 www

static (inside,outisde) public@ip2 private@ip2

Access to the first ip@ with web is working (tested by telnetting the 80 port). But nothing is permitted to the second ip@ (no reply when telnet)

I inverted the ACLs and NAT (ip@1 with ip@2) and still the same, the first is OK and not the same.

If the server is not well configured, can I see the session open when translated by the PIX but not opened on the server?

Regards,

Re: IP to IP static NAT

andrew.prince — Tue, 30 Jun 2009 09:50:30 GMT

To check the servers, if they are windows @ the command line type "netstat -a" this will tell you what ports TCP/UDP the server is listening on and has current sessions.

Another good test is try to connect to the servers on the inside!