Port Address Redirection- PIX 515e

[koshy]

Hello,

I am Koshy working with M/s ITI Limited, palakkad.

I have a problem with Port Address Redirection (PIX 515E)

I have configured static translation to a public IP with my internal servers.

Public IP 210.212.235.147 is to be translated to a.b.c.d for "www" packets.

Public IP 210.212.235.147 is to be translated to aa.bb.cc.dd for "smtp and pop3 packets.

Sadly enough requests destined for smtp as well as pop3 doesn't reach inside my network.

Below given is the configuration.

Configuration:

I have not configured NAT

pixfirewall(config)# sh access-list outside_access_in

access-list outside_access_in; 3 elements

access-list outside_access_in line 1 permit tcp any host 210.212.235.147 eq pop3 (hitcnt=0)

access-list outside_access_in line 2 permit tcp any host 210.212.235.147 eq smtp (hitcnt=0)

access-list outside_access_in line 3 permit tcp any host 210.212.235.147 eq www (hitcnt=4)

pixfirewall(config)#

pixfirewall(config)# sh static

static (inside,outside) tcp 210.212.235.147 smtp 10.75.200.3 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.147 pop3 10.75.200.3 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.147 www 10.75.200.2 www netmask 255.255.255.255 0 0

Please help me solve the problem

[harishtandon23]

Hello koshy,

I checked the configuration and static and access-list looks fine. Please let me know if you have the following command in the configuration:

access-group outside_access_in in interface outside

If yes and still the problem persist. Try the following command and test to see if that helps:

clear xlate

If the problem still occurs. Please send the sh xlate information with the complete configuration file.

If you have any questions, please feel free to contact me.

Thanks & Regards,

Harish Tandon

harishtandon23@gmail.com

[koshy]

Hello Harish,

Below given is the configuration.

pixfirewall(config)# sh run

: Saved

:

PIX Version 6.3(4)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list acl-in permit tcp any host 210.212.235.147 eq www

access-list acl-in permit tcp any host 210.212.235.148 eq smtp

access-list acl-in permit tcp any host 210.212.235.148 eq pop3

pager lines 1000

mtu outside 1500

mtu inside 1500

ip address outside 210.212.235.146 255.255.255.248

ip address inside 10.75.200.1 255.255.0.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

static (inside,outside) tcp 210.212.235.147 www 10.75.200.2 www netmask 255.255.

255.255 0 0

static (inside,outside) tcp 210.212.235.147 smtp 10.75.200.3 smtp netmask 255.25

5.255.255 0 0

static (inside,outside) 210.212.235.148 10.75.200.3 netmask 255.255.255.255 0 0

access-group acl-in in interface outside

route outside 0.0.0.0 0.0.0.0 210.212.235.145 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 10.75.200.11 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet 10.75.200.2 255.255.255.255 inside

telnet 10.75.200.11 255.255.255.255 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd lease 3600

dhcpd ping_timeout 750

terminal width 80

Cryptochecksum:xxx

: end

pixfirewall(config)#

[jmia]

Hi,

I have just connected to your public IPs i.e.

210.212.235.147 connected to port 80 (www), 210.212.235.148 connected to port 110 (pop3),

210.212.235.148 connected to port 25 (smtp)

So, your outside ACL should be:

access-list acl-in permit tcp any host 210.212.235.147 eq www

access-list acl-in permit tcp any host 210.212.235.148 eq smtp

access-list acl-in permit tcp any host 210.212.235.148 eq pop3

access-group acl-in in interface outside

Your static should be:

static (inside,outside) tcp 210.212.235.148 smtp 10.75.200.3 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.148 pop3 10.75.200.3 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.147 www 10.75.200.2 www netmask 255.255.255.255 0 0

Now save with: write mem and also isssue: clear xlate

Let me know if this helps and please rate post if it does.

Jay

[jmia]

Hi, again..

also notice that your public IP 210.212.235.148 answers to telnet on port 80, so, is your inside www server IP = 10.75.200.3 (Public IP: 210.212.235.148) OR is it 10.75.200.2 (Public IP 210.212.235.147)

Which IP is it???

Jay

[koshy]

Hello JMIA

There was some errors in the cofig I sent.

Configuration I need to work is

access-list acl-in permit tcp any host 210.212.235.147 eq www

access-list acl-in permit tcp any host 210.212.235.147 eq smtp

access-list acl-in permit tcp any host 210.212.235.147 eq pop3

access-group acl-in in interface outside

static (inside,outside) tcp 210.212.235.147 www 10.75.200.2 www netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.147 smtp 10.75.200.3 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp 210.212.235.147 pop3 10.75.200.3 pop3 netmask 255.255.255.255 0 0

Sorry 4 the error.

Kindly help.