PIX Multiple Inside Config

Unanswered Question
Feb 14th, 2008
User Badges:

This should be straight forward, but for some reason I'm missing something. I have a PIX with 6 interface


E0 Outside

E1 Inside

E2 DMZ

E3 Guest


The Guest interface is the guest VLAN for the company and I want to allow access to the Internet while blocking all of our internal stuff. Sample config is here:


int e0

nameif outside

ip add 1.1.1.1 255.255.255.0

security-level 0


int e1

nameif inside

ip add 10.10.10.1 255.255.255.0

security-level 100


int e2

nameif dmz

ip add 172.16.1.1 255.255.255.0

security level 50


int e3

nameif Guest

ip add 192.168.1.1 255.255.255.0

security level 90


nat (inside) 1 0 0

nat (Guest) 2 0 0

global (outside) 1 1.1.1.2

global (outside) 2 1.1.1.3


access-list Guest_out permit ip any any

access-gr Guest_out in interface guest


Based on the config above, that should be enough to have the Guest vlan traffic PAT to 1.1.1.3 and have no issue going out?


Am I missing something?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
acomiskey Thu, 02/14/2008 - 11:04
User Badges:
  • Green, 3000 points or more

Typo maybe, capital "G" in guest.


access-group Guest_out in interface Guest


acomiskey Thu, 02/14/2008 - 11:08
User Badges:
  • Green, 3000 points or more

Typo maybe, capital "G" in guest. Although that would not have prevented you from getting outside.


access-group Guest_out in interface Guest


abinjola Thu, 02/14/2008 - 11:14
User Badges:
  • Cisco Employee,

There isn't any issue with Typo...the config is absolutely good and would allow all IP traffic from Guest to go outside patting to 1.1.1.3


are you facing any issue ?

acomiskey Thu, 02/14/2008 - 11:20
User Badges:
  • Green, 3000 points or more

Actually there is a typo. And as I said, it would not have effected his ability to go outside.

r.lusignan Thu, 02/14/2008 - 11:21
User Badges:

Yes I am, return traffic is not being permitted back in. I can see the xlate going through ie:


Built ICMP connection for faddr x.x.x.x/0 gaddr 1.1.1.3 laddr 192.168.1.x


That outside IP i'm pinging is a router which is running debug ip icmp. I can see the source address of the ping as the global PAT'd address on the Firewall. So the config looks good, return traffic is not getting back through. The ACL on the outside interface shouldn't be blocking the traffic as it was sourced from inside..

acomiskey Thu, 02/14/2008 - 11:28
User Badges:
  • Green, 3000 points or more

That is not the case with icmp. You must allow it in your outside acl on the firewall.


This also serves as proof there was a typo, as he would have had to allow icmp as well in his Guest acl.

abinjola Thu, 02/14/2008 - 11:29
User Badges:
  • Cisco Employee,

add a line permit icmp any any echo-reply on the outside access-list, if not then create one access-g on outside permitting icmp echo-reply


you are correct firewall doesn't block traffic initiated from inside, however this is ICMP, firewall treats it stateless protocol and consider the return echo reply as different connection


They fixed this issue in code 7.0 and above with "Inspect Icmp" feature

Actions

This Discussion