How to make port redirection work?

devildoc · ‎11-20-2002

Hello,

If anyone can help me with this, then i would appreciate it.

I have a 515E PIX with 3 interfaces and IOS 6.2. I am trying to configure port redirection for one of my internal servers but it does not work. See the below configuration.

static (inside,outside) tcp x.x.x.1 smtp 10.10.10.1 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp x.x.x.1 pop3 10.10.10.2 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp x.x.x.1 www 10.10.10.2 www netmask 255.255.255.255 0 0

static (inside,outside) x.x.x.3 10.10.10.3 netmask 255.255.255.255 0 0

static (inside,outside) x.x.x.4 10.10.10.4 netmask 255.255.255.255 0 0

static (inside,outside) x.x.x.5 10.10.10.5 netmask 255.255.255.255 0 0

access-list 101 permit tcp any host x.x.x.1 eq smtp

access-list 101 permit tcp any host x.x.x.1 eq pop3

access-list 101 permit tcp any host x.x.x.1 eq www

access-list 101 permit tcp any host x.x.x.3 eq telnet

access-list 101 permit tcp any host x.x.x.4 eq ftp

access-list 101 permit tcp any host x.x.x.5 eq https

access-group 101 in interface outside

With the above configuration, only the smtp ACLS statement works (I could telnet to port 25), but the rest of the port redirection statement don't work. If i removed the smtp statement, then all of the port redirection work (i could telnet to ports 110 and 80). Anyone knows why that is the case? Thanks.

JD

gfullage · ‎11-20-2002

That doesn't sound normal? Can you provide syslogs of when you try and telnet to the pop3 and www ports, that may show us a bit more about what's going on?

devildoc · ‎11-20-2002

how can i enable syslogs for those sessions?

gfullage · ‎11-20-2002

You can't really enable it specifically for those sessions. Just do:

logging on

logging console debug

term mon

although be careful if this is a busy PIX, you'll get tons of messages. Then try telnet'ing to one of those ports and see what messages come up.

gfullage · ‎11-24-2002

Actually, can you send us your PIX config (remove the password lines and change your public IP addresses), this may tell us what's going on.

devildoc · ‎11-25-2002

Ok. So here is the pix configuration that i used. Thanks.

PIX Version 6.2(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security50

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

no names

access-list 101 permit tcp any host 63.100.100.5 eq 3389

access-list 101 permit udp any host 63.100.100.5 eq 3389

access-list 101 permit tcp any host 63.100.100.9 eq smtp

access-list 101 permit tcp any host 63.100.100.9 eq pop3

access-list 101 permit tcp any host 63.100.100.9 eq www

access-list 101 permit tcp any host 63.100.100.9 eq lotusnotes

access-list 101 permit udp any host 63.100.100.9 eq domain

access-list 101 permit tcp any host 63.100.100.50 eq www

access-list 101 permit tcp any host 63.100.100.50 eq https

access-list 101 permit tcp any host 63.100.100.80 eq www

access-list 101 permit tcp any host 63.100.100.80 eq https

access-list 101 permit tcp any host 63.100.100.90 eq https

access-list 101 permit tcp any host 63.100.100.101 eq citrix-ica

access-list 101 permit tcp any host 63.100.100.102 eq citrix-ica

access-list 101 permit icmp any any echo

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-list 105 permit tcp any host 10.10.10.10 eq domain

access-list 105 permit udp any host 10.10.10.10 eq domain

access-list 105 permit tcp any host 10.10.10.17 eq 8080

access-list 105 permit tcp any host 10.10.10.17 eq citrix-ica

access-list 105 permit tcp any host 10.10.10.18 eq 8080

access-list 105 permit tcp any host 10.10.10.18 eq citrix-ica

access-list 105 permit tcp any host 10.10.10.50 eq www

access-list 105 permit tcp any host 10.10.10.50 eq https

access-list 105 permit tcp any host 10.10.10.50 eq domain

pager lines 24

logging on

logging timestamp

logging console alerts

logging monitor notifications

logging buffered notifications

logging trap informational

logging history notifications

logging host inside 10.10.10.50

interface ethernet0 100full

interface ethernet1 100full

interface ethernet2 100full

mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip address outside 63.100.100.1 255.255.255.0

ip address inside 10.10.10.1 255.255.255.0

ip address dmz 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

no failover

failover timeout 0:00:00

failover poll 15

failover ip address outside 0.0.0.0

failover ip address inside 0.0.0.0

failover ip address dmz 0.0.0.0

pdm location 10.10.10.17 255.255.255.255 inside

pdm location 10.10.10.12 255.255.255.255 inside

pdm location 10.10.10.18 255.255.255.255 inside

pdm location 10.10.10.50 255.255.255.255 inside

pdm location 192.168.1.90 255.255.255.255 dmz

pdm location 10.10.10.10 255.255.255.255 inside

pdm location 63.100.100.20 255.255.255.255 outside

pdm location 192.168.1.80 255.255.255.255 dmz

pdm location 63.100.100.10 255.255.255.255 outside

pdm logging warnings 100

pdm history enable

arp timeout 14400

global (outside) 1 63.100.100.201-63.100.100.253 netmask 255.255.255.0

global (outside) 1 63.100.100.254

nat (inside) 1 10.10.10.0 255.255.255.0 0 0

nat (dmz) 1 192.168.1.0 255.255.255.0 0 0

static (inside,outside) tcp 63.100.100.9 smtp 10.10.10.7 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp 63.100.100.9 pop3 10.10.10.12 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp 63.100.100.9 www 10.10.10.12 www netmask 255.255.255.255 0 0

static (inside,outside) tcp 63.100.100.9 lotusnotes 10.10.10.12 lotusnotes netmask 255.255.255.255 0 0

static (inside,outside) udp 63.100.100.9 domain 10.10.10.12 domain netmask 255.255.255.255 0 0

static (inside,outside) 63.100.100.5 10.10.10.10 netmask 255.255.255.255 0 0

static (inside,outside) 63.100.100.50 10.10.10.50 netmask 255.255.255.255 0 0

static (inside,outside) 63.100.100.101 10.10.10.17 netmask 255.255.255.255 0 0

static (inside,outside) 63.100.100.102 10.10.10.18 netmask 255.255.255.255 0 0

static (dmz,outside) 63.100.100.80 192.168.1.80 netmask 255.255.255.255 0 0

static (dmz,outside) 63.100.100.90 192.168.1.90 netmask 255.255.255.255 0 0

static (inside,dmz) 10.10.10.10 10.10.10.10 netmask 255.255.255.255 0 0

static (inside,dmz) 10.10.10.12 10.10.10.12 netmask 255.255.255.255 0 0

static (inside,dmz) 10.10.10.17 10.10.10.17 netmask 255.255.255.255 0 0

static (inside,dmz) 10.10.10.18 10.10.10.18 netmask 255.255.255.255 0 0

static (inside,dmz) 10.10.10.50 10.10.10.50 netmask 255.255.255.255 0 0

access-group 101 in interface outside

access-group 105 in interface dmz

route outside 0.0.0.0 0.0.0.0 63.100.100.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 10.10.10.0 255.255.255.0 inside

http 192.168.1.0 255.255.255.0 dmz

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt noproxyarp inside

no sysopt route dnat

telnet 10.10.10.0 255.255.255.0 inside

telnet 192.168.1.0 255.255.255.0 dmz

telnet timeout 15

ssh timeout 5

terminal width 80

:end