Pix VPN & Port forwarding

[mattias]

Hi!

I have installed a Pix latest 6.x version and have some questions. Is there a way to have several ipadresses on outside interface? I want to bind diffrent rules to/from ipadresses. For example www should point to a inside server ip. Also a VPN solution should work.

Outside ip from ISP should be aaa.bbb.ccc.82 and a get VPN to work.

I now need a way to allow outside aaa.bbb.ccc.90 adress to accept ISP webserver. Is there a way to get outside interface to answar both aaa.bbb.ccc.82 and 90 adress? If so i think i can work out a config.

Kr

Mattias

[rselmecz · Accepted solution]

Hi Mattias,

If I got well the IP aaa.bbb.ccc.82 is the physical IP of the PIX and th IP aaa.bbb.ccc.90 should be an outside IP of a server behind the PIX.

In this case you'll only need th create a static entry in the PIX to answer these queries, like this ( assuming that the ouside and the inside interfaces named "ouside" and "inside" and the server's inside IP is xx.yy.zz.90 ) :

static(inside,outside) aaa.bbb.ccc.90 xx.yy.zz.90 netmask 255.255.255.255

Please let me know if not this is the situation.

Regards,

// Roland

[5220 · Accepted solution]

Mattias,

The way to do it is create static on specific port for the web traffic, ie:

static (inside,outside) tcp www www netmask 255.255.255.255

For the rest of the users you can keep the NAT or a general static.

Please rate if this helped.

Regards,

Daniel

[mattias]

Ok it?s working fine now except that the users on inside pix complain about unsteady connection to internet. I?m thinking about speed and duplex. Current is 10BaseT. They have 2 m/bit line i think. Can i use any other command on the interface to make it more stabel?

Kr

Mattias

[m.sir]

You can verify if there are some errors on interface

with command

show interface e0

You should check counters (CRC, late collision) for errors

M.