Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco Pix 525 learning experience

I decided to take the plunge and start learning a little about Cisco, the IOS, and firewall configurations.

I purchased a Cisco Pix 525 used, defaulted with Cisco Pix Security Appliance Software Version 8.0(4), unlimited license.

My plan was to work through a config and get it working as a learning platform.

I planned out a configuration as the following:

1) Comcast business class Internet through an SMC router/firewall provided by Comcast.

2) 5 Static IPs from Comcast

3) A Comcast SMC router/firewall

4) The Cisco Pix 525 (Ethernet0 connected to LAN1 on the SMC)

5) A private, internal network

6) A PC static IP'ed with,, DNS connected to Ethernet1 (inside)

All WAN IPs below are "representative".

The Comcast SMC firewall/router came out of the box with 1 static IP of When Comcast upgraded me to 5 static IPs and set the SMC in "bridge" mode, they told me my IP range was with a subnet of, a gateway address of, and DNS of After the change to "bridge mode" the SMC picked up a new WAN DHCP IP of They told me the SMC would simply pass all traffic for my static IPs to my range of - on the LAN ports.

I tested this by setting the PC to IP, Subnet, GW, DNS connected directly to the Comcast SMC. Sure enough I could browse the Internet.

I have read the SANS reading room Pix 3 interface config, watched a number of youtube pix config videos, and made much progress but I have found it impossible to get the pix to pass inside network traffic to the Internet. my private network PCs cannot reach the Internet connected to Ethernet1 with the PC setup as IP, subnet, GW, DNS

I am simply trying to setup the following:

Ethernet0 (outside), (eventually planning for all 5 static IPs to be managed on this interface)

Ethernet1 (inside),

global (outside) 1 netmask

nat (inside) 1 0 0

I have managed to connect to the PIX, run through the setup wizard, configure additional management accounts, connect with ASDM, and even get the above NAT/Route rule in place. The ASDM log shows constant "Failed to locate egress interface for UDP from INSIDE: to

So, my #1 question is what am I doing wrong on my initial setup?

Thank You

Everyone's tags (5)

Cisco Pix 525 learning experience


can you do this:

no global (outside) 1 netmask

global (outside) 1  interface



Don't forget to rate helpful posts.
New Member

Cisco Pix 525 learning experience

also add a default route point to the outside interface as below.

route (outside)

New Member

Cisco Pix 525 learning experience

Thank You for the responses. After an hour on the phone with Comcast, it turns out the SMC router was not actually passing traffic and was still NATing. they had to reload the config twice to get it to pass the traffic.

i have the PIX working with, on ethernet0 (WAN)

My next question is how do I configure the PIX to respond to/port forward multiple static WAN IPs to equipment inside the private network?

For example:

1) I would like to PAT to, port 80 (web server, yes I know it is inside and not in DMZ ) )

2) I would like to PAT to, port 25 (email server)

3) I would like to be the VPN endpoint

Basically, how to you get the PIX to manage multiple IPs or assign an IP range on ethernet0?