cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
533
Views
0
Helpful
7
Replies

PIX Multiple Inside Config

r.lusignan
Level 1
Level 1

This should be straight forward, but for some reason I'm missing something. I have a PIX with 6 interface

E0 Outside

E1 Inside

E2 DMZ

E3 Guest

The Guest interface is the guest VLAN for the company and I want to allow access to the Internet while blocking all of our internal stuff. Sample config is here:

int e0

nameif outside

ip add 1.1.1.1 255.255.255.0

security-level 0

int e1

nameif inside

ip add 10.10.10.1 255.255.255.0

security-level 100

int e2

nameif dmz

ip add 172.16.1.1 255.255.255.0

security level 50

int e3

nameif Guest

ip add 192.168.1.1 255.255.255.0

security level 90

nat (inside) 1 0 0

nat (Guest) 2 0 0

global (outside) 1 1.1.1.2

global (outside) 2 1.1.1.3

access-list Guest_out permit ip any any

access-gr Guest_out in interface guest

Based on the config above, that should be enough to have the Guest vlan traffic PAT to 1.1.1.3 and have no issue going out?

Am I missing something?

7 Replies 7

acomiskey
Level 10
Level 10

Typo maybe, capital "G" in guest.

access-group Guest_out in interface Guest

acomiskey
Level 10
Level 10

Typo maybe, capital "G" in guest. Although that would not have prevented you from getting outside.

access-group Guest_out in interface Guest

There isn't any issue with Typo...the config is absolutely good and would allow all IP traffic from Guest to go outside patting to 1.1.1.3

are you facing any issue ?

Actually there is a typo. And as I said, it would not have effected his ability to go outside.

Yes I am, return traffic is not being permitted back in. I can see the xlate going through ie:

Built ICMP connection for faddr x.x.x.x/0 gaddr 1.1.1.3 laddr 192.168.1.x

That outside IP i'm pinging is a router which is running debug ip icmp. I can see the source address of the ping as the global PAT'd address on the Firewall. So the config looks good, return traffic is not getting back through. The ACL on the outside interface shouldn't be blocking the traffic as it was sourced from inside..

That is not the case with icmp. You must allow it in your outside acl on the firewall.

This also serves as proof there was a typo, as he would have had to allow icmp as well in his Guest acl.

add a line permit icmp any any echo-reply on the outside access-list, if not then create one access-g on outside permitting icmp echo-reply

you are correct firewall doesn't block traffic initiated from inside, however this is ICMP, firewall treats it stateless protocol and consider the return echo reply as different connection

They fixed this issue in code 7.0 and above with "Inspect Icmp" feature

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: