Adding addition IP Block to PIX 520

[imanco671]

Hello Community,

I am having a hard time adding a new IP block to my PIX 520.

Here are my specs:

Hostname	AGNIPIX520	Device	PIX 520
PDM Version	3.0(4)	PIX Version	6.3(5)
User	root	Privilege Level	15
JavaScript	Enabled	Java	Enabled
Browser	Internet Explorer 8.0	JDK Version	1.5.0_05
OS	Windows XP 5.1

I have an existing external IP block on eth1 which is working fine. I have another eth3 card which I want to use for my additional IP range.

So my ISP gave me a new /27 block is addition to what I have now. This block is supposily active and nothing is needed to configure on the ISP router, it is said that it is autmatically available and ready to use once I configure my PIX.

I am using the PIX GUI and running into an error while trying to create a NAT pool "Start and end addresses overlap with existing range"

I have done the following:

1. I have filled in the eth3 IP address info:

     a. enabled: YES

     b. name: NewBlock

     c. security level: 30

     d. ip address: 173.xxx.xx.65

     e. subnet mask: 255.255.255.224

     f. hardware: ethernet3

2. physically plugged an ethernet cable in the ethernet3 port then to a laptop who has an ip address of 173.xxx.xx.66, mask: 255.255.255.224 (just as a test laptop to see if I can get the internet)

3. Used the GUI and clicked the "host/networks" tab and selectted the interface "NewBlock".

4. Edited the NewBlock-pool, clicked the "NAT" tab, clicked "Manage Pools".

5. Tried to add a pool to "NewBlock" using range 173.xxx.xx.66 - 173.xxx.xx.91

6. Receive error stating that "Start and end addresses overlap with existing range", my other range is nothing like this new range. This is the actual command that the PIX does not like:  global (NewBlock) 1 173.xxx.xx.67-173.xxx.xx.91

I have searched all throughout my PIX and cannot find any conflicting IP addresses anywhere. I have no idea what I am doing wrong.

I have posted some screen shots. Please let me know if you need me to post any other screen shot

Thanks in advance!

[Jon Marshall]

John

Can you tell where the packets are failing ?

Can you post the config of the pix plus the output of "sh nat" or "sh ip nat" (sorry can't remember which one it is)

Jon

[imanco671]

Jon,

sh nat:

nat (inside) 0 access-list inside_outbound_nat0_acl

I am not sure how to tell where the packets are failing...

John

[Jon Marshall]

John

Sorry, wrong command. Can you try connecting from inside then run "sh xlate" on the pix and post results together with current pix config.

I have to go out for a couple of hours so i'll get back to this thread later.

Jon

[imanco671]

Jon,

Sorry for the delay, here is the command response:

Result of firewall command: "sh xlate"

0 in use, 3 most used

John

[Jon Marshall]

John

If you are trying to connect from the server to the outside and you ran that command just after you tried to connect then it means traffic is not getting to the pix firewall from the WatchGuard. So if this is the case then you need to look at the WatchGuard.

Can you post current pix config ?

Jon

[Jon Marshall]

John

Been a long time since i have seen a pix with conduit statements

You have the right config on the pix. If you try to connect from the server inside to the outside and there is no translation seen when you run "sh xlate" then you need to look at WatchGuard.

Jon

[imanco671]

Hi Jon,

Still plugging away..... No success....

Dont know what else I can try.

I have another watchguard box not being used. I can configure that one possibly as a last ditch effort?

John

[Jon Marshall · Accepted solution]

John

We may have to open a new thread as it almost freezes up my computer trying to open this one

You are going to have to do some debugging on the pix as previously suggested to make sure the pix is not the issue. I don't think it is but you have to know.

Jon

[imanco671]

Hi Jon,

I got it.

I dug up an old sonicwall to test assigning it the IP address connecting to Eth3.

I was able to NAT the 173.x.x.70 address to a test laptop, so everything on the PIX worked like you instructed me.

Thanks for the great help! I am planning on buying a new Cisco firewall to use instead of this old sonicwall.

I am looking into the Cisco ASA 5510. What do you think?

John