PIX 515: Help adding a line to the access list

[salixcapital]

Hi, I need to open a port on a PIX 515.

Please can someone explain what I should be entering including the commands.

For the purposes of the explanation (so I can understand it ) I've given the different elements the following ips

Port = PPPPP

Destination IP that the machine s on my network will be contacting: XXX.XXX.XXX.XXX

The workstation on my network YYY.YYY.YYY.YYY

PIX IP: ZZZ.ZZZ.ZZZ.ZZZ

I have logged onto the PIX via Hyperterminal.

Thanks for your help.

[Jon Marshall]

Are you seeing hits on the rule in your acl applied to the inside interface ?

How does the software work ? ie. it is a normal client/server app or does it do something funny like try to initiate a connection back to your clients ?

Have you spoken to the company hosting the software to see if they can see requests coming from your public IP ?

My previous question about general internet access was to make sure NAT is setup correctly. Perhaps you could post the NAT config ?

Jon

[salixcapital]

PIX# show NAT

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

nat (DMZ) 1 10.10.0.0 255.255.255.0 0 0

PIX(config)# show access-list inside_outbound_nat0_acl

access-list inside_outbound_nat0_acl turbo-configured; 1 elements

access-list inside_outbound_nat0_acl line 1 permit ip 10.10.0.0 255.255.255.0 10

.10.0.0 255.255.255.0 (hitcnt=110)

Is show NAT the right command?

[Jon Marshall]

salixcapital wrote:
PIX# show NAT
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (DMZ) 1 10.10.0.0 255.255.255.0 0 0
PIX(config)# show access-list inside_outbound_nat0_acl
access-list inside_outbound_nat0_acl turbo-configured; 1 elements
access-list inside_outbound_nat0_acl line 1 permit ip 10.10.0.0 255.255.255.0 10
.10.0.0 255.255.255.0 (hitcnt=110)
Is show NAT the right command?

Yes, as long as you have something like -

global (outside) 1 interface or

global (outside) 1

Jon

[salixcapital]

so does that look correct in my case?

Will i just post the entire 'write term'?

[Jon Marshall]

It looks fine. Can you internal users access internet web sites ??

Other than that you can run debug on the pix to see if the packet is leaving your pix and if you are receiving anything in return eg.

debug packet outside dst     <-- this should show you packets leaving your pix when an internal client tries to connect to the remote server

debug packet outside src   <--- this should show you packets arriving at the outside interface of your pix from the remote server

However be careful with debug. You don't want to run it during peak hours, best to test out of core hours.

Jon