Camera System Behind Firewall - Help

bn_enterp · ‎06-27-2007

I am fairly new to Cisco code, and am sure I am missing something simple. If anybody has any ideas, I would greatly appreciate any assistance provided.

I have an internal security camera server that I need to access from outside the network. The specific port the camera software uses is 32001 and the server has been assigned a static address of: 192.168.1.100. I have a PIX 506E.

I have tried several things, but cannot seem to get it to work. I cannot get it work inside the network either, so there is something blocking it there as well. I have added everything to the access-list I can think of, but nothing seems to be working. I have tried adding the following code and several other lines similar to this and it will not work:

static (inside,outside) 206.206.206.207 192.168.1.100

conduit permit ip host 206.206.206.207 eq 32001 any

access-list 101 permit ip any host 192.168.1.100

Below is my config.

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security00

nameif ethernet1 inside security10

hostname Gatekeeper

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list acl_inside permit ip any any

access-list acl_inside permit icmp any any

access-list acl_outside permit icmp any any

access-list acl_outside permit ip any any

access-list 101 permit ip 192.168.0.0 255.255.255.0 host 66.66.66.66

access-list 101 permit icmp 192.168.1.0 255.255.255.0 any

access-list 101 permit ip 192.168.1.0 255.255.255.0 any

access-list 101 permit icmp 192.168.0.0 255.255.255.0 host 66.66.66.66

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 206.206.206.207 255.255.255.248

ip address inside 192.168.0.2 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 206.206.206.208

global (outside) 2 206.206.206.209

nat (inside) 1 192.168.0.0 255.255.255.0 0 0

nat (inside) 2 192.168.1.0 255.255.255.0 0 0

access-group 101 in interface outside

access-group 101 in interface inside

conduit permit tcp host 192.168.0.9 any

route outside 0.0.0.0 0.0.0.0 206.206.206.205 1

route inside 192.168.1.0 255.255.255.0 192.168.1.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd lease 3600

dhcpd ping_timeout 750

terminal width 80

: end

acomiskey · ‎06-27-2007

First of all, if it does not work from the inside when you are trying to access 192.168.1.100 on port 32001, you will not get very far getting it to work from the outside. Here is the config you need though for the outside access if you were using your pix outside interface address to access the server...

no access-group 101 in interface outside

static (inside,outside) interface 192.168.1.100 netmask 255.255.255.255

access-list outside permit tcp any host 206.206.206.207 eq 32001

access-list outside in interface outside

Also, do you have an inside router routing between 192.168.0.0/24 and 192.168.1.0/24?

This route statement is not correct

route inside 192.168.1.0 255.255.255.0 192.168.1.1 1

It needs to point towards another address on the 192.168.0.0/24 network.

route inside 192.168.1.0 255.255.255.0 192.168.0.x

I would also get rid of this as it's not needed

no access-group 101 in interface inside

bn_enterp · ‎06-27-2007

This is a remote location from our corporate office, and there is a router and a switch in addition to the PIX. The switch has 2 seperate VLANS, one for our corporate users that can only get to our VPN server and one for vendors/outside users that just need to access the internet.

The corporate users are assigned a 192.168.0.X address, vendors are assigned a 192.168.1.X address.

I thought there may be something blocking it in the PIX from working internally while I am on the 192.168.1.X network.

acomiskey · ‎06-27-2007

The traffic would not be hitting the pix for communication between a client on 192.168.1.x and the camera server 192.168.1.100.

Try pinging the server from a client and from the pix.

bn_enterp · ‎06-27-2007

Yes, that is true, that makes sense. I may have something else going on, but my main goal is to get it accessible from outside the network, there will not be any need to access it internally.

I will try what you posted in your first response and see if I can get it working.

Thank you for your input.

acomiskey · ‎06-28-2007

Any luck?

bn_enterp · ‎06-28-2007

The system is at a remote location and I have not been able to get there to try anything yet. I am hoping for today or tomorrow. I will post the results.

Thanks