11-29-2006 10:33 AM - edited 03-11-2019 02:02 AM
Greetings,
I have a PIX515 with 6.3(5). I am trying to convert some Alias Statements, original input by a former employee, and need some guidance to convert to Static Statements.
Here are a couple:
alias (inside) 10.xxx.xx.x 2xx.2xx.xx.xx 255.255.255.255
alias (inside) 2xx.2xx.xx.x 172.xxx.xxx.x 255.255.255.255
alias (dmz) 172.xxx.xxx.x 2xx.2xx.xxx.xx 255.255.255.255
Is this the proper syntax for the corresponding statements above?:
Static (inside,outside)2xx.2xx.xx.xx 10.100.xx.x netmask 255.255.255.255 0 0
Static (inside,outside)https 172.xxx.xxx.x tcp 2xx.2xx.xx.x netmask 255.255.255.255 0 0
static (dmz,outside) tcp 2xx.2xx.xx.xx https 172.xx.xx.x https netmask 255.255.255.255 0 0
11-29-2006 02:07 PM
Hello,
You can't really tell from the alias statements where those networks are.
I'm assuming that the 10.x network is on the inside interface, the 172.x network is on the dmz. is the 2xx on the outside?
--Jason
11-30-2006 04:27 AM
Jason,
Yes the 10.x network is on the inside, the 172.x is in the DMZ, and the 2xx. is the outside.
Robert
11-30-2006 06:14 AM
Ok,
Assuming these alias statements are correct:
-------------------
alias (inside) 10.xxx.xx.x 2xx.2xx.xx.xx 255.255.255.255
should be
static (inside,outside)2xx.2xx.xx.xx 10.xxx.xx.x netmask 255.255.255.255
-------------------
-------------------
alias (inside) 2xx.2xx.xx.x 172.xxx.xxx.x 255.255.255.255
This one is interesting. 2xx.2xx.xx.x is not an inside IP address. if we went strictly by the alias syntax it would be:
static (inside, dmz) 172.xxx.xxx.x 2xx.2xx.xx.x netmask 255.255.255.255
the other possibility is that the DMZ address is the real address and it's mapped to the inside as the 2xx.
Though the 2xx.xxx address isn't on the inside interface. You might want to keep an eye on this one.
the other possibility is that the DMZ address is the real address and it's mapped to the inside as the 2xx.
so it would be
static (dmz,inside) 2xx.2xx.xx.x 172.xxx.xxx.x netmask 255.255.255.255
So anyone initiating to that external address would go to the dmz.
---------------------
---------------------
alias (dmz) 172.xxx.xxx.x 2xx.2xx.xxx.xx 255.255.255.255
should be
static (dmz,outside) 2xx.2xx.xxx.xx 172.xxx.xxx.x netmask 255.255.255.255
---------------------
11-30-2006 11:33 AM
Jason,
This was very helpful. Thanks.
Robert
11-30-2006 01:18 PM
Don't forget to rate if it works. :)
--jason
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide