Glynn
Your addressing first. Your logic here is unfortunately wrong -
My reason for 255.0.0.0 is I would like the PIX not to allow anyone coming from the 10.24.48.0 network with a mask of 255.255.255.0 to access the cable modem. I need the average user to go through the Proxy Server for security reasons.
With a subnet mask of 255.0.0.0 the pix thinks it's inside interface is on the 10.x.x.x network so it will accept any 10.x.x.x address. When traffic is sent it does not include the subnet mask so the pix, as with any device, uses it's subnet mask. A better bet may be to simply use an access-list on the inside interface of the pix to only allow the relevant addresses.
So with that in mind here is the config using hosts 10.24.48.52/53/54 as the ones allowed through the pix
int gi?? <-- your outside interface
ip address dhcp setroute
nat (inside) 10.24.48.0 255.255.255.0
global (outside) 1 interface
object-group network allowed
network-object host 10.24.48.52
network-object host 10.24.48.53
network-object host 10.24.48.54
access-list inside_out permit tcp object-group allowed any eq www
access-group inside_out interface outside
Notes on the above -
1) the NAT config allows NAT for the whole subnet but we are going to use an acl to limit who can actually go through the pix so if you then need to add another 10.24.48.x address you only need to update the acl
2) the config uses an object-group for the hosts. So if you need to allow another host or remove a host you simply edit the object-group and not the acl line.
3) You are right in that you don't need any routes if your pix inside interface is in the same subnet as the clients.
4) Important point. There is an implicit deny at the end of any acl so the above acl only allows those hosts to access the internet using port 80 ie. www. If you need https/ftp then you can either add the extra lines yourself or create an port object-group for all the ports you want to allow. If you add the lines yourself they are exactly as above except for the "eq www" at the end. For https it would obviously be "eq https" etc.
If the proxy actually uses the pix to go out to the internet then you must make sure you add the access for your proxy as well ie. that would mean adding the proxy address to the object-group and adding lines in the acl for all the ports the proxy uses eg. www/https etc.
Any queries/clarification then let me know.
Jon
