Camera System Behind Firewall - Help

Unanswered Question
Jun 27th, 2007

I am fairly new to Cisco code, and am sure I am missing something simple. If anybody has any ideas, I would greatly appreciate any assistance provided.

I have an internal security camera server that I need to access from outside the network. The specific port the camera software uses is 32001 and the server has been assigned a static address of: I have a PIX 506E.

I have tried several things, but cannot seem to get it to work. I cannot get it work inside the network either, so there is something blocking it there as well. I have added everything to the access-list I can think of, but nothing seems to be working. I have tried adding the following code and several other lines similar to this and it will not work:

static (inside,outside)

conduit permit ip host eq 32001 any

access-list 101 permit ip any host

Below is my config.

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security00

nameif ethernet1 inside security10

hostname Gatekeeper

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69


access-list acl_inside permit ip any any

access-list acl_inside permit icmp any any

access-list acl_outside permit icmp any any

access-list acl_outside permit ip any any

access-list 101 permit ip host

access-list 101 permit icmp any

access-list 101 permit ip any

access-list 101 permit icmp host

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1

global (outside) 2

nat (inside) 1 0 0

nat (inside) 2 0 0

access-group 101 in interface outside

access-group 101 in interface inside

conduit permit tcp host any

route outside 1

route inside 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd lease 3600

dhcpd ping_timeout 750

terminal width 80

: end

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
acomiskey Wed, 06/27/2007 - 12:22

First of all, if it does not work from the inside when you are trying to access on port 32001, you will not get very far getting it to work from the outside. Here is the config you need though for the outside access if you were using your pix outside interface address to access the server...

no access-group 101 in interface outside

static (inside,outside) interface netmask

access-list outside permit tcp any host eq 32001

access-list outside in interface outside

Also, do you have an inside router routing between and

This route statement is not correct

route inside 1

It needs to point towards another address on the network.

route inside 192.168.0.x

I would also get rid of this as it's not needed

no access-group 101 in interface inside

bn_enterp Wed, 06/27/2007 - 12:40

This is a remote location from our corporate office, and there is a router and a switch in addition to the PIX. The switch has 2 seperate VLANS, one for our corporate users that can only get to our VPN server and one for vendors/outside users that just need to access the internet.

The corporate users are assigned a 192.168.0.X address, vendors are assigned a 192.168.1.X address.

I thought there may be something blocking it in the PIX from working internally while I am on the 192.168.1.X network.

acomiskey Wed, 06/27/2007 - 12:47

The traffic would not be hitting the pix for communication between a client on 192.168.1.x and the camera server

Try pinging the server from a client and from the pix.

bn_enterp Wed, 06/27/2007 - 12:50

Yes, that is true, that makes sense. I may have something else going on, but my main goal is to get it accessible from outside the network, there will not be any need to access it internally.

I will try what you posted in your first response and see if I can get it working.

Thank you for your input.

bn_enterp Thu, 06/28/2007 - 05:09

The system is at a remote location and I have not been able to get there to try anything yet. I am hoping for today or tomorrow. I will post the results.



This Discussion