PIX with only 1 IP

[jdepies]

Hello,

I need to set up one of my home users with the PIX firewall, and am wondering how you allow mutiple inside hosts to use PAT when there is only 1 IP available (the PIX's external IP)? When I try the global command using the ext Int IP, the command fails saying it overlaps with outside interface addresses. I know this has to be possible since the 501 unit supports PPoE with an ISP assigned DHCP address. I am just not sure how to do it.

Second, If I only have one IP address (like above), and I need to use PAT for inside users, but I also need to serve a mail and DNS server, is this possible? If the ext IP of the PIX is 1.1.1.1, can I have the PAT users use 1.1.1.1 ports 1200-65000 and then have a static command forwarding ports 25 and 53 through to an internal IP address? I know it would be a lot easier with several IPs, but the ISP will only give one without a large increase in the monthly charge.

Thanks for your help

Jeff

[mostiguy]

global (outside) 1 interface

"interface" is a magic keyword to do exactly what you seek - I have a 501 on a cable modem with one ip address.

Yes, static forwarding those two ports should be no problem at all.

[mhoda]

For second part of the problem, please use the following link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml#topic9

The concept is called PORT REDIRECTION. Thanks, Mynul

[tvanginneken]

Hi,

"When I try the global command using the ext Int IP, the command fails saying it overlaps with outside interface addresses"

Try using the keyword "interface" instead of typing the IP address

"Second, If I only have one IP address (like above), and I need to use PAT for inside users, but I also need to serve a mail and DNS server, is this possible?"

This is possible. You need to create static commands for the mail and dns servers. Make sure you speficy the port (25 and 53) when you enter the static commands. If you have a dynamic outside address, the you have to use the "interface" keyword when you enter the static command (instead of the dynamic outside ip).

If you use a dynamic address at the outside, and you want to host a DNS and Mail server (access from the internet to the inside), you need the latest version of the Pix OS (=v6.3.1) .

I hope this is clear? :-)

Regards,

Tom

[atdhingr]

hi,

do u mean to say that we need to use port redirection with statics here?

thanks

ad

[mhoda]

Hi,

Yes, thats exactly right. Thanks,

Mynul

[ovanjara]

For the first option:

1) PAT

Second part:

2) Port redirection

Check out the link below. It talks about both PAT and port redirection.

http://www.cisco.com/warp/public/707/28.html#topic10

Hope this helps.

Obaid.