Hi, thanks for the reply. Sorry but the above didnt work. I am telneting into the firewall from the client machine (192.168.2.200) and its fine so i know its not a routing issue.

Any ideas?

Thanks,

Chris

Hello,

Everything looks ok in this config. What's your source IP address normally going to be be when trying to get to the outside interface and port forwarded?

--Jason

Hi, ok i appreciate ppl saying the config is fine but it doesnt work!!

The machine ip address i want the packets forwarded to is 192.168.2.200.

Sorry im really confused!

TIA

Chris

Hi,

Make sure that 192.168.2.200 knows how to route packets back to the host initiating the connection outside the PIX ..

Telneting to the PIX from 192.168.2.200 probes that it knows how to get to the PIX's inside interface but it might not know how to get back to the host initiating the connection .. I think you could be having a routing issue here

I hope it helps .. please rate if it does !!!

Thanks for the reply. The core switch to which the pix is connected (on VLAN 1), i am on the users VLAN (VLAN 3). i can connect to machines internally no problem. I'll try and check it out.

Hi, the plot thickens. I'm checking the adsl router and (as you've guessed im not expert), but by checking the config it seems it is natting on the dialer interface?

I've attatched the config file. The firewall (10.0.0.1) connects to the router (10.0.0.2), with firewall natting the internal network (192.168.x.x)... is it right for the router to NAT again?? Maybe the packets are stopping when they hit the adsl router as it doesnt know where to send them?

Thanks,

Chris

Chris,

Basically, you are double natting.

You are hiding the 192.168.x network behind the firewall IP address.

The router is hiding the 10.x network behind the router dialer interface.

If you're going to nat like that, you need to port forward at both places - the router needs to forward the port to the firewall, and the firewall needs to route it to the host.

You appear to have the firewall configuration portion correctly done. On the router, do the following:

ip nat inside source static tcp 10.0.0.1 7111 interface Dialer0 7111

ip nat inside source static tcp 10.0.0.1 55816 interface Dialer0 55816

That should forward the ports correctly. Make sure if you have access lists defined that this traffic is allowed on the router.

Also, you may want to consider taking natting off the firewall - the router appears to know about the internal network and is pointing it back to the firewall anyway.

--Jason

Please rate this message if it solved some or all of your issue.

Ok thanks, would you be kind enough given my 877 router config from my previous posts to recommend any commands to remove the natting and make it work with the firewal? Sorry for my lack of knowledge.

TIA,

Chris

Hello,

You can't really remove the natting on the router or else your outbound connectivity won't work.

I'd just add the commands I put in above to get it working.

Thanks for the reply. I had a brain wave, couldnt i do a simple address translation, whereby 10.0.0.1 is translated to the public ip address, and any packets arriving at the interface (on any port), are translated back to 10.0.0.1... much like a default host on a DMZ for which all packets are forwaded to incase of not meting any rules.

Would that be possible? If so i think that would work.

Thanks very much for yor time