Qst about Cisco PIX 515E With Cisco PIX Security Appliance Software Version 7.0(6)

Unanswered Question
Apr 9th, 2010


I have Cisco PIX 515E With Cisco PIX Security Appliance Software Version 7.0(6).

We are using three interfaces. One outside, second WEB(for web server) & third DB(for database server)

We have published our web server and so available from public network.

Now, I want to access my website(web server) from inside network(servers connected to WEB interface) with public IP address. But it is not working.

When I try from inside of the network, the packet is handled by the default route and sent onto the outside interface. At that point, the packet disappears because the PIX does not turn the packet around and send it back inside. In fact, I'm not even sure that the NAT

rules come into play in this scenario.

So, is it possible to hit external IP of my web server from internally?

If yes than how?


Anil Oza

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Federico Coto F... Fri, 04/09/2010 - 08:28


Yes you can do it.

Let's say your internal network is

Your server dmz:


If you want to access the dmz server from your internal network, normally you have to use the 172.16.1.x address.

If you want to access it with the public IP (200.200.200.x), then you do the following:

static (dmz,inside) 200.200.200.x 172.16.1.x


ozaanil72 Wed, 05/05/2010 - 04:18


I have followed the same step but still I can not access it from my dmz(in my case WA interface) network.

I am getting bellow error.

%PIX-3-305005: No translation group found for tcp src WA:x.x.x.x/4447 dst outside:x.x.x.x/443

Below is some part of my PIX config

There are 4 inerface.

1 interface - outside 92.60.xx.x

2 interface - WA 10.38.33.x

3 interface - DB 10.38.35.x

4 interface - inside 10.38.37.x

object-group icmp-type TRACERT-PING-RESPONSE
icmp-object echo-reply
icmp-object time-exceeded
icmp-object unreachable

object-group network WEB-HOSTS
network-object host 92.60.xx.x

object-group network WEB-HOSTS-SSL
network-object host 92.60.xx.x

object-group service WEB-PORTS tcp
port-object eq www
port-object eq https

access-list OUTSIDE extended permit icmp any any object-group TRACERT-PING-RESPONSE
access-list OUTSIDE extended permit tcp any object-group WEB-HOSTS object-group WEB-PORTS
access-list OUTSIDE extended permit tcp any object-group WEB-HOSTS-SSL eq https
access-list WA extended permit tcp any any object-group WEB-PORTS

global (outside) 1 92.60.xx.x
global (outside) 2 92.60.xx.x
global (WA) 1
global (DB) 1
nat (inside) 0 access-list NO-NAT
nat (inside) 1
nat (WA) 0 access-list NO-NAT
nat (WA) 1
nat (DB) 0 access-list NO-NAT
nat (DB) 2
static (WA,outside) 92.60.xx.xx netmask
static (outside,WA) 92.60.xx.xx netmask
access-group OUTSIDE in interface outside
access-group WA in interface WA
access-group DB in interface DB
route outside 92.60.xx.x 1

Let me know if you need more information .


Anil Oza

astripat Wed, 05/05/2010 - 06:56

Hi Anil,

What I get is that you have a server located in WA interface and you want to access it from some other interface with its publically mapped ip, right? Can you tell me from which interface you want to access this server which is in WA interface?


Jennifer Halim Wed, 05/05/2010 - 17:37

You do not need this line (static statement is bidirectional):

static (outside,WA) 92.60.xx.xx netmask

(The above line can safely be removed as long as you have the following line:

static (WA,outside) 92.60.xx.xx netmask

To access the public ip address of the WA server from your inside network, you would need the following 2 statements:

static (inside,WA) netmask

static (WA,inside) 92.60.xx.xx netmask

And lastly "clear xlate" for the new configuration to work.

ozaanil72 Wed, 05/05/2010 - 21:53


I want to access it from WA interface not from inside interface.



Jennifer Halim Wed, 05/05/2010 - 22:03

If you would like to access the WA server ( from the WA subnet ( using its public ip address (92.60.xx.xx), then here is the config:

global (WA) 1 interface

same-security-traffic permit intra-interface

static (WA,WA) 92.60.xx.xx netmask

ozaanil72 Thu, 05/06/2010 - 00:51


As per you suggection, i hvae added below line

global (WA) 1 interface

same-security-traffic permit intra-interface

static (WA,WA) 92.60.xx.xx netmask

But it is still not working. Also there is no any errors in PIX log.



Jennifer Halim Thu, 05/06/2010 - 00:54

Proxy arp is also enabled on WA interface?

You should have "no sysopt noproxyarp WA" command.

Jennifer Halim Thu, 05/06/2010 - 01:22

You should enable proxy arp on WA interface for it to work.

Configure: no sysopt noproxyarp WA

ozaanil72 Thu, 05/06/2010 - 01:51

I did that. Still it is not working.

If you want than I can send you my config file.

astripat Thu, 05/06/2010 - 06:27

Hi Anil,

As suggested by halijenn , it should work with the following config:

global (WA) 1 interface

same-security-traffic permit intra-interface

static (WA,WA) 92.60.xx.xx netmask

However, the catch is that "same-security-traffic permit intra-interface" command is applicable for clear text traffic starting 7.2.x onwards. So, plrease upgrade the code to 7.2.4 and try again.



Jennifer Halim Fri, 05/07/2010 - 02:56

Hi Anil,

As Ashu advised earlier, you would need to upgrade the PIX to at least version 7.2.1 for the "same-security-traffic permit intra-interface" command to work for clear text traffic (as in your case).

Please upgrade the PIX to version 7.2.1 (I would recommend 7.2.4 as Ashu's advise) and what you are trying to achieve will work.

ozaanil72 Fri, 05/07/2010 - 03:11

Thanks to both of you for help.

last qst... what is a clear text traffic. Means it will work for only http not for https.


This Discussion