PIX 515E....To global or not to global...

PIX 515E....To global or not to global...

Post by Forres » Sat, 02 Aug 2003 11:03:13



Hello all.  As usual I am sitting here just beating my head to a pulp while
telneted into our PIX 515e.  I am trying to migrate our web and mail servers
from the outside to the inside.  I have set up the access-list no prob, as
well as have configigured dns doctoring, but all of the docs say that to set
up a translation all I should have to do is:

static (inside,outside) 205.244.xxx.xxx 172.16.2.10 dns netmask
255.255.255.255. 0 0

And create an access list to allow the specific services:

access-list IN permit tcp any host 205.244.xxx.xxx eq www

Now the question I have is: Is this all i have to do, or do I have to issue
the command:

global (outside) 1 205.244.xxx.xxx <---web server IP

It seems to me that I would need to add the IP address of the www server to
the global pat pool, but I am not sure.

Can anyone clear this up for me?

Thanks a million!

 
 
 

PIX 515E....To global or not to global...

Post by Walter Robers » Sat, 02 Aug 2003 12:20:06



:Hello all.  As usual I am sitting here just beating my head to a pulp while
:telneted into our PIX 515e.  I am trying to migrate our web and mail servers
:from the outside to the inside.  I have set up the access-list no prob, as
:well as have configigured dns doctoring, but all of the docs say that to set
:up a translation all I should have to do is:

:static (inside,outside) 205.244.xxx.xxx 172.16.2.10 dns netmask 255.255.255.255. 0 0

Where does that word 'dns' come from?

:And create an access list to allow the specific services:

:access-list IN permit tcp any host 205.244.xxx.xxx eq www

:Now the question I have is: Is this all i have to do, or do I have to issue
:the command:

:global (outside) 1 205.244.xxx.xxx <---web server IP

You do NOT need to do the 'global'. You only need to 'global' to
correspond to 'nat' statements that have the same reference id ('1'
in this case.)

One additional step you do need to take, though, is to

access-group IN in interface outside
--
Inevitably, someone will flame me about this .signature.

 
 
 

PIX 515E....To global or not to global...

Post by Rik Bai » Sat, 02 Aug 2003 09:17:57



> :static (inside,outside) 205.244.xxx.xxx 172.16.2.10 dns netmask 255.255.255.255. 0 0

> Where does that word 'dns' come from?

PIX command reference 6.2 and beyond, for DNS doctoring.

    [no] static [(internal_if_name, external_if_name)] {global_ip |
interface} local_ip [dns] [netmask mask | access-list acl_id] [max_conns [emb_limit [norandomseq]]]

 
 
 

PIX 515E....To global or not to global...

Post by RM » Mon, 04 Aug 2003 10:58:04


The only reason you would do a global would be if there were other servers
or workstations that need to pass through the PIX that you do not have a
static for.  You will need the "nat (inside) 1 0 0" command, the nat command
actually turns on the pix to pass traffic from the inside to the outside.
You will also want to apply the access list to the outside interface
inbound.  email me if you need more assistance.

-D


Quote:> Hello all.  As usual I am sitting here just beating my head to a pulp
while
> telneted into our PIX 515e.  I am trying to migrate our web and mail
servers
> from the outside to the inside.  I have set up the access-list no prob, as
> well as have configigured dns doctoring, but all of the docs say that to
set
> up a translation all I should have to do is:

> static (inside,outside) 205.244.xxx.xxx 172.16.2.10 dns netmask
> 255.255.255.255. 0 0

> And create an access list to allow the specific services:

> access-list IN permit tcp any host 205.244.xxx.xxx eq www

> Now the question I have is: Is this all i have to do, or do I have to
issue
> the command:

> global (outside) 1 205.244.xxx.xxx <---web server IP

> It seems to me that I would need to add the IP address of the www server
to
> the global pat pool, but I am not sure.

> Can anyone clear this up for me?

> Thanks a million!

 
 
 

1. Global Village Global Transfer ZModem Init String?

     I'm trying to receive files from a non-techie Mac user on my OS/2
     PC running PMComm software, via a direct modem-to-modem connection.
     The Mac user is running Global Village's Global Transfer software.

     PMComm on my machine looks for the ZModem init string "rz" followed
     by a carriage return before it will start downloading a file
     sent by a remote user.

     Global Transfer must use a different ZModem init string, because I
     have to manually jump-start PMComm's downloading of all files sent
     by this Mac user.

     Since PMComm allows for programming the ZModem init string in its
     setup options, I'd like to know what ZModem init string Global
     Transfer uses.

     Thanks to all in advance,
________________________________________________________
                             L. Mark Stone

2. Categories on protocols (LONG)

3. 525 Pix is not roaming global ranges

4. visual basic?

5. PIX 515 to PIX 515e not passing traffic

6. WANTED: ][gs clock info.

7. Temporary extra global ip on Pix 501

8. real beginner's question

9. Pix 506 with two global addresses

10. PIX & PAT & global command

11. PIX configuration troubles (NAT and global)

12. PIX: "sysopt noproxyarp" disables ARP for static/global IPs?