New Public IP - Need to Modify in Pix 515e

[kurt11429]

Our IP addresses changed. The public ip assigned to the pix changed, the ip assigned to the dmz changed also. How do I modify this in the Pix 515e?

[kurt11429]

PIX Version 6.3(4)

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security50

enable password ** encrypted

passwd ** encrypted

hostname ciscopix

domain-name myCompany.com

clock timezone EST -5

clock summer-time EDT recurring

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list vpn-myCompany_splitTunnelAcl permit ip any any

access-list inside_outbound_nat0_acl permit ip any 10.1.1.0 255.255.255.0

access-list outside_cryptomap_dyn_20 permit ip any 10.1.1.0 255.255.255.0

access-list outside_in permit tcp any host 71.230.73.114 eq www

access-list outside_in permit tcp any host 71.230.73.114 eq https

access-list IN_DMZ permit ip host 172.18.254.10 10.0.0.0 255.0.0.0

access-list IN_DMZ permit tcp host 172.18.254.10 any

pager lines 24

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip address outside 71.230.73.113 255.255.255.248

ip address inside 192.168.0.254 255.255.255.0

ip address dmz 172.18.254.254 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool vpnpool 10.1.1.1-10.1.1.254

pdm location 192.168.254.100 255.255.255.255 inside

pdm location 192.168.0.250 255.255.255.255 inside

pdm location 172.18.254.10 255.255.255.255 dmz

pdm location 10.0.0.0 255.0.0.0 outside

pdm location 192.168.254.251 255.255.255.255 inside

pdm location 192.168.254.251 255.255.255.255 outside

pdm history enable

arp timeout 14400

global (outside) 10 interface

global (dmz) 10 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 10 0.0.0.0 0.0.0.0 0 0

static (dmz,outside) 71.230.73.114 172.18.254.10 netmask 255.255.255.255 0 0

static (dmz,inside) 71.230.73.114 172.18.254.10 netmask 255.255.255.255 0 0

access-group outside_in in interface outside

access-group IN_DMZ in interface dmz

route outside 0.0.0.0 0.0.0.0 69.218.74.118 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server RADIUS (inside) host 192.168.0.250 7b231a330250d02c timeout 10

aaa-server LOCAL protocol local

http server enable

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map client authentication RADIUS

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup vpn-myCompany address-pool vpnpool

vpngroup vpn-myCompany dns-server 192.168.0.250

vpngroup vpn-myCompany wins-server 192.168.0.254

vpngroup vpn-myCompany default-domain myCompany.local

vpngroup vpn-myCompany split-tunnel vpn-myCompany_splitTunnelAcl

vpngroup vpn-myCompany idle-time 1800

vpngroup vpn-myCompany password **

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:1234

: end

[kurt11429]

Basically 71.230.73.114 and 71.230.73.113 need to be changed to something like 68.230.73.114 and 68.230.73.113

[Fernando_Meza]

Hi you need to change the below entries

ip address outside 71.230.73.113 255.255.255.248

ip address dmz 172.18.254.254 255.255.255.0

From config mode ( conf t ) type in

ip address outside x.x.x.x m.m.m.m

ip address dmz y.y.y.y m.m.m.m

where x.x.x.x is the IP address for you OUTSIDE interface

y.y.y.y is the IP address for you DMZ interface

m.m.m.m is the the subnet mask

Your ISP should be able to tell you which one is supposed to be used on the Outside interface of you PIX.

I hope it helps .. please rate it if it does !!!

[kurt11429]

Are these the correct commands to run. I'm using fake ip address so they are different in previous post.

NO route outside 0.0.0.0 0.0.0.0 69.218.74.113 1

NO static (dmz,outside) 69.218.74.114 172.18.254.10 netmask 255.255.255.255 0 0

NO static (dmz,inside) 69.218.74.114 172.18.254.10 netmask 255.255.255.255 0 0

route outside 0.0.0.0 0.0.0.0 70.91.227.38 1

ip address outside 70.91.227.33 255.255.255.248

static (dmz,outside) 70.91.227.34 172.18.254.10 netmask 255.255.255.255 0 0

static (dmz,inside) 70.91.227.34 172.18.254.10 netmask 255.255.255.255 0 0

[Fernando_Meza]

Yes .. that looks Ok .. what about the Ip for your DMZ interface ..?

[Fernando_Meza]

You also need to modify the below entries from you access-list to allow www and https access to your webserver

access-list outside_in permit tcp any host NEW WEB PUBLIC IP eq www

access-list outside_in permit tcp any host NEW WEB PUBLIC IP eq https

can you post show access-list and I will tell you exactly what you need to do.

[Fernando_Meza]

Also ... be aware that the remote clients will need to modify their VPN profile and point it to

70.91.227.33