Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

opening up a PIX for all traffic(to start)

We have two private line T-1s coming in from customers that directly connect to our network and we decided we needed to put a firewall up between their networks and ours even though there is no public traffic traversing any of these connections. The two Ts land on a 25XX that connect to our 506E which then connects to another 25XX that is inside our network. All NATing is disabled so that connectivity to remote servers can still be reached. We thought we had everything in place but when telneting in to some of our remote sites inside our network and then pinging out from them the ping died at the inside of the pix, but we could ping to those sites from the outside of the network/pix. (Since I'm not on site and this has to be an off-hours installation it has limited my window of opportunity to work on this project). I think I have the problem figured out but wanted to see if I could get some feedback here?

25XX on the outside

S0 10.31.X.X

S1 10.29.X.x

E0 172.20.50.1

25XX on the inside

E0 172.20.51.1

E1 192.1.1.1

Remote site routers all connected via EIGRP to the 25XX

S0 172.20.x.x

E0 192.x.x.x

Here is a copy of the pix config that sits :

PIX Version 6.3(3)

interface ethernet0 10full

interface ethernet1 10full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxx

passwd xxxx

hostname mahc-gate3

domain-name ma-hc.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list private permit ip any any

access-list private permit gre any any

access-list private permit icmp any any

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 172.20.50.2 255.255.255.0

ip address inside 172.20.51.2 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

static (inside,outside) 172.20.51.0 172.20.51.0 netmask 255.255.255.0 0 0

static (inside,outside) 192.0.0.0 192.0.0.0 netmask 255.0.0.0 0 0

access-group cmh-csm in interface outside

route inside 0.0.0.0 0.0.0.0 172.20.51.1 1

route outside x.0.0.0 255.0.0.0 172.20.50.1

route outside 10.0.0.0 255.0.0.0 172.20.50.1

route outside x.x.x.0 255.255.255.0 172.20.50.1

route outside x.x.x.0 255.255.255.0 172.20.50.1

route outside x.x.0.0 255.255.0.0 172.20.50.1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http 192.0.0.0 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

My thought is that I should have opened up the static command:

static (inside,outside) 172.20.51.0 172.20.51.0 netmask 255.255.255.0 0 0

And have it read 172.20.0.0 leaving out the 51 block since when pinging the remote routers 172 network dies at the pix since it isn't in the 172.20.51.0 network?

My other question is why I had to put route outside commands in to the PIX instead of just using the default route out? Before I put those commands in to the pix we could not ping out past the EO connected to the outside int on the pix.

Before i go back out to implement I wanted to get some sort of feedback re this problem.

Thanks again!!

1 REPLY
Community Member

Re: opening up a PIX for all traffic(to start)

Technically I don't understand why you need to put a PIX in place. Since the PIX is not required to perform any specific Firewall or VPN features according to your description. If you only require ACL or maybe route filter function, your existing routers are already able to achieve.

BTW, if you are not using NAT, you can use NAT 0 command. You are using access-group with access-list "cmh-csm" but not being defined. I don't quite get you are not trying to perform with your routing defined.

112
Views
0
Helpful
1
Replies
CreatePlease to create content