I decided to take the plunge and start learning a little about Cisco, the IOS, and firewall configurations.
I purchased a Cisco Pix 525 used, defaulted with Cisco Pix Security Appliance Software Version 8.0(4), unlimited license.
My plan was to work through a config and get it working as a learning platform.
I planned out a configuration as the following:
1) Comcast business class Internet through an SMC router/firewall provided by Comcast.
2) 5 Static IPs from Comcast
3) A Comcast SMC router/firewall
4) The Cisco Pix 525 (Ethernet0 connected to LAN1 on the SMC)
5) A private 192.168.1.0, 255.255.255.0 internal network
6) A PC static IP'ed with 192.168.1.19, 255.255.255.0, DNS 18.104.22.168 connected to Ethernet1 (inside)
All WAN IPs below are "representative".
The Comcast SMC firewall/router came out of the box with 1 static IP of 22.214.171.124. When Comcast upgraded me to 5 static IPs and set the SMC in "bridge" mode, they told me my IP range was 126.96.36.199-188.8.131.52/29 with a subnet of 255.255.255.248, a gateway address of 184.108.40.206, and DNS of 220.127.116.11. After the change to "bridge mode" the SMC picked up a new WAN DHCP IP of 18.104.22.168. They told me the SMC would simply pass all traffic for my static IPs to my range of 22.214.171.124 - 126.96.36.199 on the LAN ports.
I tested this by setting the PC to IP 188.8.131.52, Subnet 255.255.255.248, GW 184.108.40.206, DNS 220.127.116.11 connected directly to the Comcast SMC. Sure enough I could browse the Internet.
I have read the SANS reading room Pix 3 interface config, watched a number of youtube pix config videos, and made much progress but I have found it impossible to get the pix to pass inside network traffic to the Internet. my private network PCs cannot reach the Internet connected to Ethernet1 with the PC setup as IP 192.168.1.19, subnet 255.255.255.0, GW 192.168.1.1, DNS 18.104.22.168.
I am simply trying to setup the following:
Ethernet0 (outside) 22.214.171.124, 255.255.255.248 (eventually planning for all 5 static IPs to be managed on this interface)
Ethernet1 (inside) 192.168.1.1, 255.255.255.0
global (outside) 1 126.96.36.199 netmask 255.255.255.248
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
I have managed to connect to the PIX, run through the setup wizard, configure additional management accounts, connect with ASDM, and even get the above NAT/Route rule in place. The ASDM log shows constant "Failed to locate egress interface for UDP from INSIDE: 192.168.1.19/XXXXX to 188.8.131.52/53
So, my #1 question is what am I doing wrong on my initial setup?
Thank You for the responses. After an hour on the phone with Comcast, it turns out the SMC router was not actually passing traffic and was still NATing. they had to reload the config twice to get it to pass the traffic.
i have the PIX working with 184.108.40.206, 255.255.255.248 on ethernet0 (WAN)
My next question is how do I configure the PIX to respond to/port forward multiple static WAN IPs to equipment inside the private network?
1) I would like 220.127.116.11 to PAT to 192.168.1.10, port 80 (web server, yes I know it is inside and not in DMZ ) )
2) I would like 18.104.22.168 to PAT to 192.168.1.15, port 25 (email server)
3) I would like 22.214.171.124 to be the VPN endpoint
Basically, how to you get the PIX to manage multiple IPs or assign an IP range on ethernet0?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...