Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX...

PIX-501

PIX Firewall Version 6.3(4)

PIX Device Manager Version (3.0(2)

Here's what I want to accomplish...

Internal network = 192.168.1.0

Remote network = 12.34.56.0

Need remote machine (12.34.56.78) to connect through PIX to local machine (192.168.1.1). Remote network is directly connected to PIX via Cat-5.

How do I configure the PIX to allow this?

Thanx.

8 REPLIES

Re: PIX...

Create a static-

static (inside,outside) [outside ip] 192.168.1.1 netmask 255.255.255.255

Then add an entry in your ACL to allow the ports in.

access-list outside_access permit tcp host 12.34.56.78 host [outside ip] eq 80

The [outside ip] should be in the same subnet as your outside interface (I believe it's 12.34.56.x).

Hope that helps.

New Member

Re: PIX...

Hmm...must be missing something. I've attached my config. Thanx.

Re: PIX...

Looks good. Sometimes you have to do a clear xlate before it will work. Note that a clear xlate will clear all NAT translations! Also check the hit counts on the ACL.

New Member

Re: PIX...

Yeah, I've completely cleared and reloaded the config, but it is still not working. the client from the remote network, 10.20.30.40 cannot connect to the client on the local network 192.168.1.1. The remote network is directly connected to the PIX via CAT5 run. Thanx again.

Re: PIX...

Can you throw a little diagram together w/IP's (hide any public)? I thought the client was local on the outside interface? Any hits on the ACL?

New Member

Re: PIX...

Take a look at the attached image. I tried to make it as accurate as possible. The rules on the PIX allow all traffic from the 10.20.30.0 network. The rules on the 2600 only allow traffic from the 10.20.30.0 network through, one-way, toward the 192.168.1.0 network. I'm open to suggestions. This configuration worked perfectly for a number of years until the week before last. Thanx.

Re: PIX...

What changed in the past two weeks that you know of? In the 2600 do you see traffic come through? Any hist on the ACL on the PIX/ASA?

New Member

Re: PIX...

I am unaware of any changes in the last two weeks. Unfortunately, I have to wait to access the 2600 as I'm not on site and have forgotten the IP address. No history on the PIX.

130
Views
0
Helpful
8
Replies