External access config with PPPoE and Dynamic IP on outside interface

[rlacroix]

I am looking for some help with configuring a PIX 515 (6.3(1)) to allow any traffic on the outside interface (Internet) to access an FTP server on the inside interface. I have tried everything but can not seem to make this work.

Here is the setup:

- Outside interface (E0) is DSL using PPPoE and a dynamic IP assigned by the ISP and is configured using PAT on the PIX (which appears to be the only way to do this when you only have 1 IP address (no IP POOL)).

- Inside interace (E1) is 192.168.1.1 netmask 255.255.255.0

- Inside network is 192.168.1.0 netmask 255.255.255.0

- E1 is connected to a Cisco 2950 switch and has other computers connected to it.

- The FTP server IP is 192.168.1.11 netmask 255.255.255.0

- Since I have cleared the PIX, there are currently no access or translation rules in place other than the PIX defaults. If I try to create translations to the outside interface, PDM reports that it can not do so to the outside interface and since I only have 1 outside IP address, I can not create an address pool for NAT.

I am open to suggestions / help from anyone on this. I am sure that it is possible but I just can not seem to make it work.

Thanks in advance.

Richard

[mmeditz]

Hi Richard,

PDM doesn't support all the features of the CLI and this may be an example. It sounds like you want to do port redirection and this document will be helpful in describing how to configure it using the CLI.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml

Keep in mind that when you configure the Port Redirection w/ the static command, that you'll also need to permit the FTP traffic through the PIX w/ an ACL applied inbound on the Outside Interface.

C-ya,

Mike

[rlacroix]

Thanks Mike,

I will give that a shot. I was kind of thinking along the same lines that the PDM does not support the full feature set of CLI.

I will let you know how it works out when I have a minute to test this later this week or next week.

Richard

[rlacroix]

Hello Mike,

Still no joy on this issue. Here are the commands that I issued.

access-list 101 permit tcp any interface outside eq ftp

static (inside, outside) tcp interface ftp 192.168.1.11 ftp netmask 255.255.255.255 0 0

access-group 101 in interface outside

This resulted in a "connection refused" for inboud and locked out all outbound connections from the other inside users.

Richard