mapping IP's

[langemechanical]

Prior to the installation of my PIX 501, my ISP provider had one of my static internal IP addresses mapped to a static outside IP. How do I do this using the PIX ?

[nkhawaja]

Hi,

The quick start guide can guide you.

Additionally you can get the sample configs here

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration#Software_Samples_and_Tips

you just need to have this command (if using CLI)

static (inside,outside) public_ip_address private_ip_address

Thanks

Nadeem

[kagodfrey]

Hi

You need the following command to create a static mapping:

static (inside,outside) out.side.ip.address in.side.ip.address netmask 255.255.255.255 0 0

If you are then looking to allow, say, http traffic then you need an access-list allowing it configured on the outside interface of the pix:

access-list acl_outside permit tcp any host out.side.ip.address eq www

access-group acl_outside in interface outside

See

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008009402f.shtml or

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094466.shtml

for further examples

Hth

Kev

[langemechanical]

Will these setups allow me to access the internal IP via the public IP that is mapped???

[nkhawaja]

Hi,

Surely, the static and the access-list will allow the access to private IP using its public IP

Thanks

Nadeem

[langemechanical]

I added the following lines

static (inside,outside) outsideIP insideIP netmask 255.255.255.255 0 0

access-list ACL_OUTSIDE permit tcp any host outsideIP eq www

access-group ACL_OUTSIDE in interface outside

When I try to acess the outside IP (public ip ) I get the following lines in the syslog

<166>Jun 17 2004 07:42:02: %PIX-6-302013: Built inbound TCP connection 637 for outside:216.xxx.xxx.xx/1980 (216.xxx.xxx.xx/1980) to inside:172.xx.x.xxx/80 (216.xxx.xxx.xx/80)

<166>Jun 17 2004 07:44:04: %PIX-6-302014: Teardown TCP connection 637 for outside:216.xxx.xxx.xx/1980 to inside:172.xx.x.xxx/80 duration 0:02:01 bytes 0 SYN Timeout

What am I doing wrong ?????