Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX515 IOS Version6.1(4) Configuration

I have a Cisco PIX515 firewall that I'd like to configure and install on my LAN. I have managed a Cisco 3640 router installed on my LAN and prefer to put the firewall behind the router to protect my LAN.

The LAN Gateway is netmask which is the routers fastethernet0/0. Fasethernet0/1 of the router 3640 is netmask My LAN subnet is

I prefer to give my inside IP address to the PIX as netmask

Would you be able to help me with this configuration please ASAP??.

I also have two hosts coming into two servers here which have their internal IP addresses as and These two server external IP addresses are 210.*.*.195 and and both have a netmask of

Summary Details of the above:

LAN Subnet:

Cisco 3640 Router IP Address:

E0/0 -

E0/1 - 210.*.*.194

PIX Inside IP:

Client Host IP:

(Client 1) Inside IP:

Outside IP:

(Client 2) Inside IP:

Outside IP:

Hear from you soon.


Samuel Pakoa

Port Vila


Hall of Fame Super Blue

Re: PIX515 IOS Version6.1(4) Configuration


There are a lot of things to cover here - let me know if you need further clarification.

1) if you want to put the pix behind the router then you will need another subnet to connect the pix external interface to the router internal interface.

So you don't have to setup up new default gayeways for your clients i suggest you move the address to the pix inside interface.

The use another subnet for the pix outside/router inside interface.

For examples sake lets say you allocate for this.

Pix outside interface

router internal interface

2) On the router you will need to add a route for the internal network

ip route

3) On the pix you need a default route pointing to the router

route outside

4) You don't say where you want to do the NAT for your clients and these two machines you are giving access to. Lets assume you are going to leave it on the router

On the pix

nat (inside) 0

This tells the pix not to NAT any clients as they go out. The NAT will still be done on your router.

5) You still need to do something about the 2 machines. On the pix

static (inside,outside) netmask

static (inside,outside) netmask

The NAT to public addressing will still happen on your router.

5) You will need to have an access-list on the outside interface of your pix for access to these 2 machines.

You don't say which hosts and what ports so you will need to modify this access-list.

access-list acl_inbound permit host "x.x.x.1" eq 23

access-list acl_inbound permit host "x.x.x.1" eq 23

access-list acl_inbound permit host "x.x.x.2" eq 23

access-list acl_inbound permit host "x.x.x.2" eq 23

Note if you are familiar with object groups you could simplify this a bit.

Hope this makes sense.


New Member

Re: PIX515 IOS Version6.1(4) Configuration

Thank you Jon,

The configuration you submitted has worked and I can ping the required ip addresses from my LAN.

With regards to the two hosts, aslo has a global ip address of 210.x.x.195 and has a global ip address of The two hosts will be accessing the internal addresses from the 210.x.254.x addresses. These two hosts need to access and for port 1433 (SQL).

Please could you update the access-list, otherwise all the rest of the configuration seems fine for now and will inform you on how I go with it this evening.



Hall of Fame Super Blue

Re: PIX515 IOS Version6.1(4) Configuration

Hi Samuel

Glad things are working.

Could i just clarify something ? & are on your internal network. You present these through the firewall as and

What are the IP addresses of the hosts that will be accessing these servers ? It's a little unclear from your post.


CreatePlease login to create content