PIX 501 PPPoE w/ Static NAT loss of connectivity

[kerco]

I have a {should be} very simple setup. PIX 501 with PPPoE on outside interface, 3 inside clients using PAT and 1 inside client that I am attempting to use a static address mapping on to permit communication with this host from the outside using a particular service. I have done many of these before where there was a ADSL router in front of the PIX but this is the first where I have used the PIX as the PPPoE client. Whenever I use the static NAT for the one host it loses all connectivity beyond the PIX outside interface. When I get rid of the static mapping it goes through PAT just fine. I have spent several hours trouble-shooting this and checking many of the obvious things but I am at a loss right now ... unless it might be an issue with the IP address that was assigned by the ISP for use with the static NAT. Any thoughts on this would be greatly appreciated.

Thank You

[dbellaze]

When you create the static does the machine referenced in the static get out just fine?

If you do a one to one static this will happen, if you want to map a service make sure to map the protocol and port as well.

Example - This maps telnet, 5.5.5.5 is the outside IP and 10.1.1.1 is the inside host IP.

static (inside,outside)tcp 5.5.5.5 23 10.1.1.1 23 net 255.255.255.255

Daniel

[dbellaze · Accepted solution]

Sorry, in your case the static would look like this because of the dynamic IP.

static (inside,outside) interface 23 10.1.1.1 23 netmask 255.255.255.255

Daniel

[kerco]

That's not quite it. I have another public IP in addition to the one on the outside interface of the PIX. so I have used { static (inside,outside) pub_ip, priv_ip eq port_num}. When I use this the host that has the static mapping looses all connectivity to the outside world. Never seen that before. ???

Thank you for your reply.

[dbellaze]

Ok, it sounds like its possible that the IP you are using is not routed to you properly or at all. Is it the same range as the outside IP?

When you enable the static are you able to trace to that IP and port from the internet?

Daniel

[kerco]

Yes, it is in the same range. This is what I was thinking also. But, I would like to have my "ducks in a row" so to speak before I confront the ISP. That is why I sought advice here first. No, I haven't attempted to trace from the outside. However, when a trace route is initiated from the host while the static mapping is in place, it never even generates a return from the ISP's router.

[a.alekseev]

could you post your configuration?

[kerco]

Here it is:

PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password ****************** encrypted

passwd ******************** encrypted

hostname XXXXXXX

domain-name XXXXXXXX

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

<--- More --->

fixup protocol tftp 69

names

access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit icmp any any unreachable

access-list outside_access_in permit icmp any any time-exceeded

access-list outside_access_in permit tcp host 216.135.8.X host 216.135.10.X eq 3389

access-list outside_access_in permit tcp host 216.135.8.X host 216.135.10.X eq 3389

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 216.135.10.X 255.255.255.0 pppoe setroute

ip address inside 10.10.10.1 255.0.0.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) 216.135.10.X 10.10.10.5 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

<--- More --->

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh 216.135.8.X 255.255.255.255 outside

ssh 216.135.8.X 255.255.255.255 outside

ssh timeout 5

console timeout 0

vpdn group pppoe1 request dialout pppoe

vpdn group pppoe1 localname car

vpdn group pppoe1 ppp authentication pap

vpdn username car password ******

terminal width 80

: end

Very basic. Have done many of these with no problem. {Usually with a router in front of the PIX} I really think it's a problem with the ISP's routing tables. But, I want to be sure before I approach them.

Thanks.

[dbellaze]

Looks good to me. Are you just trying to get certain ports to work for that inside host?

I would try doing a static for all the IP's in your range to see if any of them work at all.

If you only need specific ports you can map ports from the outside interface IP for now as a work around.

static (inside,outside)tcp|udp ext_ip ext_port int_ip int_port netmask 255.255.255.255

Daniel

[dbellaze]

Sorry also remember to add an ACL entry to permit the traffic to the static mapping.

Daniel

[kerco]

Yes, I am just trying to allow RDP traffic into that one host. We do this ALL the time and it's the simplest thing in the world. My client only has that ONE additional IP beyond the one on the external interface.

So, you are saying that even though the other hosts are PAT-ing through the IP at the external interface, I can still pass ports though it to a particular host ???

[jmia]

Try using key word 'interface' on your ststic.

> static (inside,outside) tcp interface 3389 10.10.10.5 3389 netmask 255.255.255.255 0 0

Save with: write mem and also issue: clear xlate

Let me know if this works.

Jay

[dbellaze]

Yes Jay is right. Use the interface keyword that I suggested in one of my first posts when I assumed you were using the outside interface IP.

Of course my example used telnet so you would change it to whatever port you are using.

Daniel

[kerco]

Thanks guys! I will give that a try later today.

I will let you know if it works or not.

[kerco]

By the way, what would the ACL for this look like?

Thanks,

Jim