Alex,
I'd like to follow-up and try to tie together all the good responses you've received about your PIX 501.
First, a few things about the PIX firewall. While some of the commands on the PIX are related to Cisco IOS commands, these are really different operating systems and it takes a bit of getting used to before a new user becomes comfortable.
Please be aware that when working at the CLI, almost EVERYTHING is done from CONFIGURATION mode as opposed to Privileged mode like a router.
Okay, let's get the server talking to the PIX and while we're at it, provide access via the spare computer if you'd like. Go to the command line of the PIX via the console port and follow these commands after resetting to factory defaults as nagel suggests -- I'm going to assume the hostname on the PIX is "pixfirewall":
pixfirewall> enable
password: (hit return - the default "password")
pixfirewall# config t
!
! your default interface names are "outside" for ethernet0 and inside for e1
!
pixfirewall(config)# ip address outside x.x.x.x 255.255.x.x ! This is the static IP address & netmask that the ISP provided to you
[ You can also set this up to use the ISP's DHCP server to obtain an IP address... ]
[ pixfirewall(config)# ip address outside dhcp ]
pixfirewall(config)# ip address inside 192.168.16.1 255.255.x.x ! I'm assuming the .1 address is available - use your internal netmask
pixfirewall(config)# interface e0 10full ! Your other options besides 10full are auto and 10baset (half-duplex)
pixfirewall(config)# interface e1 100full ! This is your internal 4-port FE switch
[ use the following if you need to shutdown your outside interface in the future ]
[ pixfirewall(config)# interface e0 shut ]
pixfirewall(config)# http 192.168.16.0 255.255.255.248 inside ! This allows the first 13 addresses to access the PIX via PDM or you can dedicate a single host (the server) as johnroche suggests
pixfirewall(config)# http server enable
pixfirewall(config)# nat (inside) 192 192.168.16.0 255.255.x.x ! Your inside network; the 192 is your NAT_ID
pixfirewall(config)# global (outside) 192 interface ! This is PAT or NAT overload
pixfirewall(config)# route outside 0 0 y.y.y.y ! The 0 0 is short for 0.0.0.0 0.0.0.0 --- y.y.y.y is your ISPs router
[ If you setup the outside interface using DHCP, the ISP will pass the PIX the default route when you use the "setroute" option as follows: ]
[ pixfirewall(config)# ip address e0 dhcp setroute ]
pixfirewall(config)# static (inside,outside) tcp interface 80 192.168.16.2 80 ! maps http requests to the SBS
pixfirewall(config)# access-list outside_in permit tcp any host x.x.x.x eq 80 ! allows the http requests inside
pixfirewall(config)# access-list outside_in permit icmp any host x.x.x.x echo-reply ! allows responses to inside echo-requests that are blocked by default
pixfirewall(config)# access-list outside_in deny ip any any
pixfirewall(config)# access-group outside_in in interface outside
pixfirewall(config)# write mem
Remember to replace the x.x.x.x with your dedicated IP address from the ISP.
I made the assumption that you only need to allow web access to the SBS from the Internet; if you also need secure web access via SSL, you'll need to add another static NAT entry for port 443 as well as another access control entry under "outside_in".
You can use the "hostname" command (same as the IOS command) if you'd like to change the name of your PIX and there may be a few other commands that are interesting, but this should get you up and running.
Finally, use the trusty "show ver" command to determine what your existing license is (10, 50, or unlimited) and also what your Finesse OS version is. You may need either a 50 or unlimited user license as mhellman suggests and you probably want to get your hands on the appropriate version of the command reference.
Hope this helps!!
vrs
