Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX 506E v6.3 IP Addressing

Hi,

I have a customer who has PIX 506E installed with one Public IP address on the Outside Interface of the PIX and another one mapped to services as shown below:

access-list outside_access_in permit icmp any any

access-list outside_access_in permit tcp any host 217.x.x.130 eq www

access-list outside_access_in permit tcp any host 217.x.x.130 eq smtp

ip address outside 217.x.x.134 255.255.255.248

This customer would like to use only one IP address both for the Outside Interface of the PIX and also for mapping to services.

Is this possible? I appreciate your suggestions.

Regards,

1 ACCEPTED SOLUTION

Accepted Solutions
Gold

Re: PIX 506E v6.3 IP Addressing

Sure you can....

Example below.... for SMTP

access-list outside_in permit tcp any host 200.222.111.69 eq smtp

access-group outside_in in interface outside

ip address outside 200.222.111.69 255.255.255.252

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Save with.. wr m and also issue clear xlate

The important command is 'interface' on the static.

Hope it helps and pls rate posts.

2 REPLIES
Gold

Re: PIX 506E v6.3 IP Addressing

Sure you can....

Example below.... for SMTP

access-list outside_in permit tcp any host 200.222.111.69 eq smtp

access-group outside_in in interface outside

ip address outside 200.222.111.69 255.255.255.252

static (inside,outside) tcp interface smtp smtp netmask 255.255.255.255 0 0

Save with.. wr m and also issue clear xlate

The important command is 'interface' on the static.

Hope it helps and pls rate posts.

New Member

Re: PIX 506E v6.3 IP Addressing

Hi,

Thanks for your response. The scenario is change from my first post.

In the new scenario, I was asked to change the Outside Interface IP address to the one already mapped to SMTP,WWW, and HTTPS. That means I now have the following:

access-list outside_access_in permit tcp any host 217.x.x.237 eq https

access-list outside_access_in permit tcp any host 217.x.x.237 eq smtp

access-list outside_access_in permit tcp any host 217.x.x.237 eq www

ip address outside 217.x.x.237 255.255.255.248

ip address inside 192.168.16.254 255.255.255.0

global (outside) 1 interface

nat (inside) 0 access-list NONAT

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) GPM-Server GPM-Server netmask 255.255.255.255 0 0

static (inside,outside) 217.x.x.237 192.168.16.1 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

access-group inside_access_out in interface inside

route outside 0.0.0.0 0.0.0.0 217.x.x.233 1

When I configured the PIX as above, I couldn't access the Internet from the LAN(192.168.16.0) with the PIX Outside Interface IP as .237. But when I changed it back to .236 (which was the original config) I can access the Internet from the LAN.

Is there something I am missing?

NB: The 217.x.x.237 is currently used for MX Record.

Best regards.

104
Views
5
Helpful
2
Replies
CreatePlease login to create content