06-27-2007 12:16 PM - edited 03-11-2019 03:36 AM
I am fairly new to Cisco code, and am sure I am missing something simple. If anybody has any ideas, I would greatly appreciate any assistance provided.
I have an internal security camera server that I need to access from outside the network. The specific port the camera software uses is 32001 and the server has been assigned a static address of: 192.168.1.100. I have a PIX 506E.
I have tried several things, but cannot seem to get it to work. I cannot get it work inside the network either, so there is something blocking it there as well. I have added everything to the access-list I can think of, but nothing seems to be working. I have tried adding the following code and several other lines similar to this and it will not work:
static (inside,outside) 206.206.206.207 192.168.1.100
conduit permit ip host 206.206.206.207 eq 32001 any
access-list 101 permit ip any host 192.168.1.100
Below is my config.
PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security00
nameif ethernet1 inside security10
hostname Gatekeeper
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list acl_inside permit ip any any
access-list acl_inside permit icmp any any
access-list acl_outside permit icmp any any
access-list acl_outside permit ip any any
access-list 101 permit ip 192.168.0.0 255.255.255.0 host 66.66.66.66
access-list 101 permit icmp 192.168.1.0 255.255.255.0 any
access-list 101 permit ip 192.168.1.0 255.255.255.0 any
access-list 101 permit icmp 192.168.0.0 255.255.255.0 host 66.66.66.66
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 206.206.206.207 255.255.255.248
ip address inside 192.168.0.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 206.206.206.208
global (outside) 2 206.206.206.209
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
nat (inside) 2 192.168.1.0 255.255.255.0 0 0
access-group 101 in interface outside
access-group 101 in interface inside
conduit permit tcp host 192.168.0.9 any
route outside 0.0.0.0 0.0.0.0 206.206.206.205 1
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
: end
06-27-2007 12:22 PM
First of all, if it does not work from the inside when you are trying to access 192.168.1.100 on port 32001, you will not get very far getting it to work from the outside. Here is the config you need though for the outside access if you were using your pix outside interface address to access the server...
no access-group 101 in interface outside
static (inside,outside) interface 192.168.1.100 netmask 255.255.255.255
access-list outside permit tcp any host 206.206.206.207 eq 32001
access-list outside in interface outside
Also, do you have an inside router routing between 192.168.0.0/24 and 192.168.1.0/24?
This route statement is not correct
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
It needs to point towards another address on the 192.168.0.0/24 network.
route inside 192.168.1.0 255.255.255.0 192.168.0.x
I would also get rid of this as it's not needed
no access-group 101 in interface inside
06-27-2007 12:40 PM
This is a remote location from our corporate office, and there is a router and a switch in addition to the PIX. The switch has 2 seperate VLANS, one for our corporate users that can only get to our VPN server and one for vendors/outside users that just need to access the internet.
The corporate users are assigned a 192.168.0.X address, vendors are assigned a 192.168.1.X address.
I thought there may be something blocking it in the PIX from working internally while I am on the 192.168.1.X network.
06-27-2007 12:47 PM
The traffic would not be hitting the pix for communication between a client on 192.168.1.x and the camera server 192.168.1.100.
Try pinging the server from a client and from the pix.
06-27-2007 12:50 PM
Yes, that is true, that makes sense. I may have something else going on, but my main goal is to get it accessible from outside the network, there will not be any need to access it internally.
I will try what you posted in your first response and see if I can get it working.
Thank you for your input.
06-28-2007 04:58 AM
Any luck?
06-28-2007 05:09 AM
The system is at a remote location and I have not been able to get there to try anything yet. I am hoping for today or tomorrow. I will post the results.
Thanks
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide