I have an older PIX firewall, it is a PIX-515 running PDM Version 3.0(4) and PIX Version 6.3(5). I am trying to integrate it into a small business network (~15 users). The business has a comcast business gateway with 1 static address that is used for a PBX/VOIP telephone server/system (through a consumer router, which handles DHCP, that feeds a 24 port netgear switch, into which the phone server and phones are plugged into). I do not intend to use the firewall on that network though.
The gateway is also currently plugged into an Extreme networks 24 port switch into which a server and user PCs are plugged into, with the server, which runs SBS 2011, handling DHCP/RWA/PPTP VPN duties. All computers on this "data" network, including the comcast gateway, are assigned 192.168.254.xxx addresses.
I would like to put the PIX firewall between the comcast gateway and the data switch to secure this network. Unfortunately, I have not had much success. Although I was able to get the firewall to handle outgoing traffic just fine (users could access web pages, email, etc.), I was unable to allow incoming connections from the internet to reach the server (the business needs PPTP VPN and RWA functionality to be available to remote users). I was able to eventually allow incoming connections from the outside interface to the inside interface by allowing any host/network on the outside to reach any host/network on the inside and allowing any type of connection, although this, I believe, makes the firewall pretty much useless. Even with any/any host/network allowed, specifying https/443 and/or PPTP/1723 as the allowed communication types on the source and/or destination ports prevents the connection.
I have the gateway setup to port forward incoming requests on ports 443 and 1723 to an address (192.168.252.2 - the firewall outside IP is 192.168.252.253 and the gateway is 192.168.252.254) and then tried to translate that address to 192.168.254.2 on the inside interface. I also tried to place the firewall into the DMZ of the gateway (no bridged mode available on this gateway), and either way does appear to work, but I believe that my access list rules prevent any connection when they should seemingly be allowing it, due to the omission of a source/destination port/protocol in favor of "any" allowing the connection to occur.
I do have access to PDM (using a virtual machine running XP/IE8/Ancient Java), in case that is helpful. I also have telnet access working.
I have tried PAT and NAT with no real difference.
I have attached the results of a "write t" command for reference, but please keep in mind that I have placed the server between two internal networks for testing purposes (192.168.253.xxx is my test "outside" network).
Any recommendations would be greatly appreciated. Thanks for reading!
