Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Can you host a server behind a PIX 506 with only 1 public IP?

I have a PIX 506 running 6.11 on a cable modem with 1 static IP. This is on the outside interface and I have it running pat/nat for my internal network 192.168.123.0 255.255.255.0. This works, and I can surf from any pc on my lan.

From my reading here and in the docs it looks like I can push inbound traffic requests (ie web, ftp, etc) to that static IP to a single lan IP. I have included my config attempt to do this below. Any sugestions for makeing this work (or that it won't with just one IP) would be VERY helpful.

Thanks

Miles

PIX Version 6.1(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password PCAkFB917CJz92LJ encrypted

passwd PCAkFB917CJz92LJ encrypted

hostname gateway

domain-name endeavour.net

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

access-list 101 permit icmp any any

access-list 101 permit tcp 192.168.123.0 255.255.255.0 any

access-list 101 permit udp 192.168.123.0 255.255.255.0 any

access-list 110 permit tcp any host 24.216.220.160 eq www

access-list 110 permit tcp any host 24.216.220.160 eq ftp

access-list 110 permit tcp any host 24.216.220.160 eq pop3

access-list 110 permit tcp any host 24.216.220.160 eq smtp

access-list 110 permit udp any host 24.216.220.160 eq domain

access-list 110 permit tcp any host 24.216.220.160 eq 5631

access-list 110 permit tcp any host 24.216.220.160 eq 5632

access-list 110 permit tcp any host 24.216.220.160 eq ident

pager lines 24

interface ethernet0 auto

interface ethernet1 auto

mtu outside 1500

mtu inside 1500

ip address outside 24.216.220.160 255.255.0.0

ip address inside 192.168.123.254 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 192.168.123.1 255.255.255.255 inside

pdm location 192.168.123.51 255.255.255.255 inside

pdm location 0.0.0.0 255.255.255.255 outside

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp interface www 192.168.123.1 www netmask 255.255.255.255 0 0

static (inside,outside) tcp interface smtp 192.168.123.1 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp interface ftp 192.168.123.1 ftp netmask 255.255.255.255 0 0

static (inside,outside) tcp interface domain 192.168.123.1 domain netmask 255.255.255.255 0 0

static (inside,outside) udp interface domain 192.168.123.1 domain netmask 255.255.255.255 0 0

static (inside,outside) tcp interface pop3 192.168.123.1 pop3 netmask 255.255.255.255 0 0

static (inside,outside) tcp interface ident 192.168.123.1 ident netmask 255.255.255.255 0 0

static (inside,outside) udp interface 113 192.168.123.1 113 netmask 255.255.255.255 0 0

static (inside,outside) tcp interface 5631 192.168.123.1 5631 netmask 255.255.255.255 0 0

static (inside,outside) tcp interface 5632 192.168.123.1 5632 netmask 255.255.255.255 0 0

access-group 101 in interface outside

route outside 0.0.0.0 0.0.0.0 24.216.51.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http 192.168.123.51 255.255.255.255 inside

http 192.168.123.0 255.255.255.0 inside

snmp-server host inside 192.168.123.1

snmp-server location *****

snmp-server contact Miles Holt

snmp-server community ******

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet 192.168.123.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

terminal width 80

1 REPLY
New Member

Re: Can you host a server behind a PIX 506 with only 1 public IP

FYI I found the problem in a earlier post. Add the following to the above and it works:

access-group 110 in interface outside

Hope this helps others.

Miles

185
Views
0
Helpful
1
Replies
CreatePlease login to create content