I have a PIX 506 running 6.11 on a cable modem with 1 static IP. This is on the outside interface and I have it running pat/nat for my internal network 192.168.123.0 255.255.255.0. This works, and I can surf from any pc on my lan.
From my reading here and in the docs it looks like I can push inbound traffic requests (ie web, ftp, etc) to that static IP to a single lan IP. I have included my config attempt to do this below. Any sugestions for makeing this work (or that it won't with just one IP) would be VERY helpful.
Thanks
Miles
PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password PCAkFB917CJz92LJ encrypted
passwd PCAkFB917CJz92LJ encrypted
hostname gateway
domain-name endeavour.net
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 101 permit icmp any any
access-list 101 permit tcp 192.168.123.0 255.255.255.0 any
access-list 101 permit udp 192.168.123.0 255.255.255.0 any
access-list 110 permit tcp any host 24.216.220.160 eq www
access-list 110 permit tcp any host 24.216.220.160 eq ftp
access-list 110 permit tcp any host 24.216.220.160 eq pop3
access-list 110 permit tcp any host 24.216.220.160 eq smtp
access-list 110 permit udp any host 24.216.220.160 eq domain
access-list 110 permit tcp any host 24.216.220.160 eq 5631
access-list 110 permit tcp any host 24.216.220.160 eq 5632
access-list 110 permit tcp any host 24.216.220.160 eq ident
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 24.216.220.160 255.255.0.0
ip address inside 192.168.123.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.123.1 255.255.255.255 inside
pdm location 192.168.123.51 255.255.255.255 inside
pdm location 0.0.0.0 255.255.255.255 outside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www 192.168.123.1 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.123.1 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp 192.168.123.1 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface domain 192.168.123.1 domain netmask 255.255.255.255 0 0
static (inside,outside) udp interface domain 192.168.123.1 domain netmask 255.255.255.255 0 0
static (inside,outside) tcp interface pop3 192.168.123.1 pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ident 192.168.123.1 ident netmask 255.255.255.255 0 0
static (inside,outside) udp interface 113 192.168.123.1 113 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5631 192.168.123.1 5631 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5632 192.168.123.1 5632 netmask 255.255.255.255 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 24.216.51.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.123.51 255.255.255.255 inside
http 192.168.123.0 255.255.255.0 inside
snmp-server host inside 192.168.123.1
snmp-server location *****
snmp-server contact Miles Holt
snmp-server community ******
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.123.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
