PIX Multiple Inside Config

Unanswered Question
Feb 14th, 2008

This should be straight forward, but for some reason I'm missing something. I have a PIX with 6 interface

E0 Outside

E1 Inside

E2 DMZ

E3 Guest

The Guest interface is the guest VLAN for the company and I want to allow access to the Internet while blocking all of our internal stuff. Sample config is here:

int e0

nameif outside

ip add 1.1.1.1 255.255.255.0

security-level 0

int e1

nameif inside

ip add 10.10.10.1 255.255.255.0

security-level 100

int e2

nameif dmz

ip add 172.16.1.1 255.255.255.0

security level 50

int e3

nameif Guest

ip add 192.168.1.1 255.255.255.0

security level 90

nat (inside) 1 0 0

nat (Guest) 2 0 0

global (outside) 1 1.1.1.2

global (outside) 2 1.1.1.3

access-list Guest_out permit ip any any

access-gr Guest_out in interface guest

Based on the config above, that should be enough to have the Guest vlan traffic PAT to 1.1.1.3 and have no issue going out?

Am I missing something?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
acomiskey Thu, 02/14/2008 - 11:04

Typo maybe, capital "G" in guest.

access-group Guest_out in interface Guest

acomiskey Thu, 02/14/2008 - 11:08

Typo maybe, capital "G" in guest. Although that would not have prevented you from getting outside.

access-group Guest_out in interface Guest

abinjola Thu, 02/14/2008 - 11:14

There isn't any issue with Typo...the config is absolutely good and would allow all IP traffic from Guest to go outside patting to 1.1.1.3

are you facing any issue ?

acomiskey Thu, 02/14/2008 - 11:20

Actually there is a typo. And as I said, it would not have effected his ability to go outside.

r.lusignan Thu, 02/14/2008 - 11:21

Yes I am, return traffic is not being permitted back in. I can see the xlate going through ie:

Built ICMP connection for faddr x.x.x.x/0 gaddr 1.1.1.3 laddr 192.168.1.x

That outside IP i'm pinging is a router which is running debug ip icmp. I can see the source address of the ping as the global PAT'd address on the Firewall. So the config looks good, return traffic is not getting back through. The ACL on the outside interface shouldn't be blocking the traffic as it was sourced from inside..

acomiskey Thu, 02/14/2008 - 11:28

That is not the case with icmp. You must allow it in your outside acl on the firewall.

This also serves as proof there was a typo, as he would have had to allow icmp as well in his Guest acl.

abinjola Thu, 02/14/2008 - 11:29

add a line permit icmp any any echo-reply on the outside access-list, if not then create one access-g on outside permitting icmp echo-reply

you are correct firewall doesn't block traffic initiated from inside, however this is ICMP, firewall treats it stateless protocol and consider the return echo reply as different connection

They fixed this issue in code 7.0 and above with "Inspect Icmp" feature

Actions

This Discussion