Re: PIX501 NAT Problem

From: BlankReg (me_at_here.now)
Date: 03/09/04 

Date: Tue, 9 Mar 2004 08:01:27 -0000

Yannick,

The NAT configuration looks fine at the first glance.

You cannot ping beacuse these are ICMP messages and the reply has nothing to
identify that it is the result of the outgoing message. To allow pings
through the PIX you need to add an access-list, to allow these replies
through the firewall, and apply this to the outside interface.

access-list Outside-Inbound permit icmp any any echo-reply
access-group Outside-Inbound in interface Outside

Ping is not necessarily the best test of connectivity when a firewall is in
the way. You should have found that TCP traffic (WWW etc) was OK anyway.

Regards,

Reg

"Yannick Bétemps" <yannick@remove-nospam-alternetic.com> wrote in message
news:c2i8hk$i1g$1@news-reader5.wanadoo.fr...
> Hi all,
> I'm sure many people have already asked for advices about PIX501 nat
> configuration but inspite of all the info I found on the net I cant make
> this work.
> So here is the network :
>
> (local network: 192.168.10.0)
> |
> (inside PIX501: 192.168.10.5)
> (outside PIX501: 62.161.111.17)
> |
> (RANGE 62.161.111.16-23)
> (CISCO router as a gateway at address 62.161.111.22)
> |
> (internet)
>
> I used several basic configurations for NAT for the PIX 501. Off course
> I also set 192.168.10.5 as a gateway for PC on my local network.
>
> There may be something wrong in my pix config but since I'm not a
> firewall wizard I just cant find what :-(
>
> I cant ping anything outside from inside (ie I cant ping the gateway
> from the inside network for example, but I can ping it from the PIX)
>
> If anyone has an idea about that I'd be glad to hear it
>
> Building configuration...
> : Saved
> :
> PIX Version 6.3(1)
> interface ethernet0 auto
> interface ethernet1 100full
> nameif ethernet0 outside security0
> nameif ethernet1 inside security100
> enable password XXXXXXX encrypted
> passwd YYYYYY encrypted
> hostname pixfirewall
> domain-name mydomain.fr
> fixup protocol ftp 21
> fixup protocol h323 h225 1720
> fixup protocol h323 ras 1718-1719
> fixup protocol http 80
> fixup protocol ils 389
> fixup protocol rsh 514
> fixup protocol rtsp 554
> fixup protocol sip 5060
> fixup protocol sip udp 5060
> fixup protocol skinny 2000
> fixup protocol smtp 25
> fixup protocol sqlnet 1521
> names
> pager lines 24
> mtu outside 1500
> mtu inside 1500
> ip address outside 62.161.111.17 255.255.255.0
> ip address inside 192.168.10.5 255.255.255.0
> ip audit info action alarm
> ip audit attack action alarm
> pdm logging informational 100
> pdm history enable
> arp timeout 14400
> global (outside) 1 62.161.111.19
> nat (inside) 1 0.0.0.0 0.0.0.0 0 0
> route outside 0.0.0.0 0.0.0.0 62.161.111.22 1
> timeout xlate 0:05:00
> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
> 1:00:00
> timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
> timeout uauth 0:05:00 absolute
> aaa-server TACACS+ protocol tacacs+
> aaa-server RADIUS protocol radius
> aaa-server LOCAL protocol local
> http server enable
> http 192.168.10.0 255.255.255.0 inside
> no snmp-server location
> no snmp-server contact
> snmp-server community public
> no snmp-server enable traps
> floodguard enable
> telnet 192.168.10.0 255.255.255.0 inside
> telnet timeout 5
> ssh timeout 5
> console timeout 0
> dhcpd auto_config outside
> terminal width 80
> Cryptochecksum:55a69e77c4bb08e8900ea7622ca878ba
> : end
> [OK]
>
> Thanks in advance
> Yannick

Relevant Pages

  • Re: restore factory defaults
    ... To reset the PIX Firewall to factory default, log into the PIX, erase ... Password Recovery and AAA Configuration Recovery Procedure for the PIX ... fixup protocol http 80 ...
    (comp.dcom.sys.cisco)
  • Re: PIX501 config question
    ... ping out and get replies back.. ... access-list outside_access_in permit icmp any host thumper-outside ... will allow a machine sitting inside your pix to ping, ... >> fixup protocol http 80 ...
    (comp.security.firewalls)
  • Re: PIX 501 routing issues
    ... You cannot PING the far interface of a PIX. ... Find another way to test routing through the PIX. ... fixup protocol dns maximum-length 512 ...
    (comp.dcom.sys.cisco)
  • Re: PIX501 config question
    ... all ICMP Echo Replies inside inorder to beable to ping to outside. ... I say welcome to Cisco PIX! ... > fixup protocol http 80 ...
    (comp.security.firewalls)
  • Re: newbie cisco pix 501 config problem
    ... There is a basic routing problem in your configuration. ... > I'm also new to the PIX firewalls, but after reading a book "Cisco PIX ... > fixup protocol http 80 ... > icmp permit any information-reply outside ...
    (comp.security.firewalls)