Multiple IP addresses on PIX 501

[jasonbegley]

trying to use static (inside,outside) and access list to make use of aditional ip.

access-list acl_out permit icmp any any echo-reply

access-list acl_out permit icmp any any unreachable

access-list acl_out permit icmp any any time-exceeded

access-list acl_out permit tcp any host address1 eq www

access-list acl_out permit tcp any host address1 eq smtp

access-list acl_out permit tcp any host address1 eq pop3

access-list acl_out permit tcp any host address1 eq domain

access-list acl_out permit icmp any any

access-list acl_out permit udp any host address1 eq domain

access-list acl_out permit udp any host address1 eq 27960

access-list acl_out permit tcp any host address1 eq imap4

static (inside,outside) tcp address1 www 10.100.10.10 www netmask 255.255.255.255 0 0

static (inside,outside) tcp address1 smtp 10.100.10.10 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp address1 pop3 10.100.10.10 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp address1 domain 10.100.10.10 domain netmask 255.255.255.255 0 0

static (inside,outside) udp address1 domain 10.100.10.10 domain netmask 255.255.255.255 0 0

static (inside,outside) udp address1 27960 10.100.10.10 27960 netmask 255.255.255.255 0 0

static (inside,outside) tcp address1 imap4 10.100.10.10 imap4 netmask 255.255.255.255 0 0

static (inside,outside) tcp address1 https 10.100.10.10 https netmask 255.255.255.255 0 0

^current config^

access-list acl_out permit tcp any host adddress2 eq smtp

static (inside,outside) adddress2 10.100.10.11 netmask 255.255.255.255

-or-

access-list acl_out permit tcp any host adddress2 eq smtp

static (inside,outside) tcp adddress2 smtp 10.100.10.11 225 netmask 255.255.255.255 0 0

[Patrick Iseli]

Should be

access-list acl_out permit tcp any host adddress2 eq smtp

static (inside,outside) adddress2 10.100.10.11 netmask 255.255.255.255

This will NAT your public SMTP server IP to your internal Private IP.

Can please tell me why did you configure all the statics with port redirect ? Is address1 the PIX'es outside IP, in this case it would make sense. But as

you have another IP on the public range this makes not sense.

Usually you are using port redirection for installtion that have just one public IP.

If your address1 is not the outside IP address you could remove 8 statics and replace it with one !

static (inside,outside) address1 10.100.10.10 netmask 255.255.255.255

sincerely

Patrick

[jasonbegley]

address1 is the outside interface. I have tried

access-list acl_out permit tcp any host adddress2 eq smtp

static (inside,outside) adddress2 10.100.10.11 netmask 255.255.255.255

but it doesn't work. I do a show xlate and the entries do not show up. Also my isp states that the ip is not showing up in their ARP table. Are there any special considerations for routing ips to the pix? Would my isp need to route the additional ip to my interface ip? Also my smtp server runs on a different port than 25.

[Patrick Iseli]

After you have done a change in the static or nat configuration, you need to do a " clear xlate " and a "clear arp" on the PIX.

But be aware that this kills all sessions on the PIX !!

sincerely

Patrick

[jasonbegley]

still not able to connect after clear arp and xlate

[paddyxdoyle]

Hi,

Can you route to address2 from the internet?

You can use an internet looking glass to do a traceroute to address2

http://www.linx.net/tools/stats/looking-glass.thtml?site=LINX-London

If it is routing correctly, what are you seeing in the PIX logs when you attempt a connection?

Rgds

Paddy

[jasonbegley]

Got it working. found a typo in access list.

Thanks!