configuring Translation on PIX 506E

[silverfoxx]

Have one pix 506e and i have to do the following, can anyone please help me out or little understanding on NAT / Translation would be great.

1. pix 506e is connected to outside int with 2600 router, this router is connected to a gateway in an telecom exchange (which is actually my destination to reach through this pix)

2. inside int of pix 506e is connected to internal lan.

3. the administrator of this router( with whom we will establish commnucation by reaching their gateway eventually) has given me 4 ips form his network side say IP_Z which i have to configure on my PIX so that when my servers will try to reach his gateway he will not see my internal LAN ips but will see the IP_Z which he had given me. according to him i am suppose to do a translation from intertal LAN ip to IP_Z.

now i have configured the pix so that when from the pix i ping to his router i get success, i can ping the gateway which is in exchange from my pix, for this i just created a route on pix

route outside 0.0.0.0 0.0.0.0 IP_Gateway.

coming back to the question, i created a static route on pix

static (inside,outside) IP_Z Internal_LAN_IP netmask 255.255.255.255

but when i try to ping from my server to outside ip int of pix which has an IP Address from the same network subnet as his router intf has which is connect to pix outside intf (i hope it's clear), i get no response and the same results are when i try to ping the gateway from my server. do i need to applie an access-list allowing, i know for icmp i have to allow it since for lower security intface cannot access high security interface.

In short what i want is that on a PIX506E, what is the config to make the inside address/inside lan traffic say 10.10.1.1 leave the outside as 172.16.1.1 and I also need traffic coming into the outside interface destined for 172.16.1.1 to translate to 10.10.1.2

[Patrick Iseli]

Ping is not a stateful protocol. To allow pings from the inside to the outside interface you need to create an access-list. If you want to ping the same interface that you are physicly connected you need to configure the "icmp" command.

example:

See: Handling ICMP Pings with the PIX Firewall

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

The PIX and the traceroute Command

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800e9312.shtml

examples:

Traveroute

Microsoft:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

access-list 101 permit icmp any host YourPublicIP echo-reply

UNIX:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

ICMP command example

icmp deny any outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host 192.168.1.30 echo inside

icmp permit host 192.168.1.31 echo inside

icmp permit host 192.168.1.20 echo inside

icmp permit host 192.168.1.40 echo inside

icmp permit host 192.168.1.100 echo inside

sincerely

Patrick

[silverfoxx]

thanks patrick but i believe i need little more assistance, because i dont get it. i am pinging from the machine inside the pix meaning 172.1.1.4(machine IP) to 10.10.1.1 (pix outside interface) but i can't, i have even applied the access-list as you told me to.

access-list 101 permit icmp any host 10.10.1.1 echo

access-list 101 permit icmp any host 10.10.1.1 echo-reply

access-list 101 permit icmp any host 10.10.1.1 source-quench

access-list 101 permit icmp any host 10.10.1.1 unreachable

access-list 101 permit icmp any host 10.10.1.1 time-exceeded

access-group 101 in interface outside

but everything has gone in vain.. but if i ping to inside interface of pix(172.16.1.1.2) from the same machine 172.16.1.4 i can do it without a problem and i am ping without any access-list at all. i also have NAT

static (inside,outside) 10.10.1.5 172.16.1.4 netmask 255.255.255.255

[Patrick Iseli]

You cannot ping the PIX outside interface from the inside network. The PIX does not allow that.

You can ping the outside interface from the outside network if you configure the < icmp > command.

Or you can ping the outside router (def gateway) from the inside and all other hosts behind the PIX (Internet) if you configure an < access-list >.

sincerely

Patrick

[sebastan_bach]

hi patrick could u pls tell me that is it possible to have a dynamic outside nat without having a static inside,outside .is it possible. how to achieve bi-directional nat i mean dynamic inside nat and dynamic outside nat. is it possible. pls help .

sebastan

[silverfoxx]

thanks patrick.

i tried to ping the router outside the pix (def gateway) by applying access-list as following

access-list 101 permit icmp any host 10.10.1.10 echo-reply

access-list 101 permit icmp any host 10.10.1.10 source-quench

access-list 101 permit icmp any host 10.10.1.10 unreachable

access-list 101 permit icmp any host 10.10.1.10 time-exceeded

access-group 101 in interface outside

and still i cannot ping this router outside pix.