Re: Another Static question

hbalfour · ‎11-15-2005

Hi

Using a PIX 506e, I have an Exchange server, and use the static command to show it's public IP on outgoing connections. My static command looks like this:

static (inside,outside) x.x.x.x y.y.y.y netmask 255.255.255.255 0 0

Can I put any protocol attributes in? Currently all outgoing traffic is stamped with my Email's public IP address. I was thining of something like:

static (inside,outside) x.x.x.x smtp y.y.y.y smtp netmask 255.255.255.255 0 0

The reason i want to do this is beacuse my network setup is like:

LAN->ISA->PIX->Internet

All traffic coming out of the ISA server comes through the one NIC, and so has a single IP address.

Thanks in adavnce

HBalf1

jackko · ‎11-15-2005

please excuse me for not fully understanding the requirement.

anyhow, the static statement you are after should be:

static (inside,outside) tcp x.x.x.x smtp y.y.y.y smtp netmask 255.255.255.255

with this static statement, of i should say port forwarding, the same public ip can be used for other public service such as running a web server.

e.g.

static (inside,outside) tcp x.x.x.x 80 z.z.z.z 80 netmask 255.255.255.255

hbalfour · ‎11-15-2005

Hi Jackko

I think you understood the question fully, judging by your answer.

I did try that altered static statement, which looks good. However if I apply it then my email seems to stop flowing in!!

I am not sure if I have made a mistake somewhere or not. I post my config in case that might have some bearing. Do I need to upgrade to v7.0 do you think?

Thanks for your input.

HBalf

:

PIX Version 6.3(4)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname HistPIX

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

no fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list outside-in permit tcp any host x.x.x.51 eq smtp

access-list outside-in permit tcp any host x.x.x.62 eq pptp

access-list outside-in permit gre any host x.x.x.62

pager lines 24

logging on

logging buffered debugging

logging trap warnings

logging host inside 172.16.0.2

mtu outside 1500

mtu inside 1500

ip address outside x.x.x.50 255.255.255.240

ip address inside 172.16.0.1 255.255.0.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 x.x.x.52-x.x.x.60 netmask 255.255.255.240

global (outside) 1 x.x.x.61 netmask 255.255.255.240

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) x.x.x.51 172.16.0.4 netmask 255.255.255.255 0 0

access-group outside-in in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.49 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

tftp-server inside 172.16.0.2 pix/config/viatest

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:xxxx

: end

[OK]

jackko · ‎11-15-2005

no static (inside,outside) x.x.x.51 172.16.0.4 netmask 255.255.255.255

static (inside,outside) tcp x.x.x.51 25 172.16.0.4 25 netmask 255.255.255.255

clear xlate

just wondering if you did issue "clear xlate" after modifying the static statements.

hbalfour · ‎11-16-2005

Hi jaccko

Thanks for your comments. (I normaly save the config and reload to ensure changes have taken.) I made the changes and it still does not work! I have copied the show xlate below, whcih verfies the command 'took' properely - or so I presume.

I have a no fixup smtp 25 command - would this make any difference to the static command I am trying to get to work?

Global x.x.x.56 Local 172.16.0.103

Global x.x.x.51 Local 172.16.0.4

HistPIX(config)# clear xlate

HistPIX(config)# show xlate

3 in use, 4 most used

Global x.x.x.57 Local 172.16.0.103

Global x.x.x.58 Local 172.16.0.4

PAT Global x.x.x.51(25) Local 172.16.0.4(25)

HistPIX(config)# show xlate

3 in use, 4 most used

Global x.x.x.57 Local 172.16.0.103

Global x.x.x.58 Local 172.16.0.4

PAT Global x.x.x.51(25) Local 172.16.0.4(25)

HistPIX(config)# show xlate

4 in use, 4 most used

Global x.x.x.59 Local 172.16.0.171

Global x.x.x.57 Local 172.16.0.103

Global x.x.x.58 Local 172.16.0.4

PAT Global x.x.x.51(25) Local 172.16.0.4(25)

HistPIX(config)# show xlate

3 in use, 4 most used

Global x.x.x.59 Local 172.16.0.171

Global x.x.x.57 Local 172.16.0.103

Global x.x.x.58 Local 172.16.0.4

HistPIX(config)#

(The .103 and .171 are a syslog server and a MAC user, if you are wondering why the traffix does not come from 172.16.0.4)

Thanks for your help

HB