cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
209
Views
0
Helpful
1
Replies

PIX with single public IP

michael.pearl
Level 1
Level 1

Customer has a cable router providing ISP service to their LAN. They have 1 public static IP address. They also have a PIX 501 that they want to sit between their cable router and their internal LAN.

All the literature I've found assumes that there's two public IPs available. What's the best way to set this up?

1 Reply 1

tvanginneken
Level 4
Level 4

Hi,

I am using a pix 501 with only one public ip address on the outside.

When you specify the global command, just use the keyword 'interface' instead of an ip address. Like this

nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

When you want to allow inbound access to an internal server (mail server, web server, ...), use the 'static' command in combination with a tcp/udp port. Like this:

static (inside, outside) tcp interface 25 25 netmask 255.255.255.255

I have an access-list like this applied to allow inbound mail traffic:

access-list outside-in permit tcp any interface outside eq 25

access-group outside-in in interface outside.

Don't forget to specify the default gateway to the Internet:

route outside 0.0.0.0 0.0.0.0

Kind Regards,

Tom

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: