Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

PIX 501 Help Please!!!!!

Ok I have been through every thread on this forum and have found this same question posed several times but no answers seem to work for what I have currently and I never saw anyone say "Hey that worked" so I am posting it again......I know how to do port redirection on a static route on the PIX 501 or at least in theory how to do it(209.x.x.x being the outside interface and 10.x.x.x being the inside:

fixup protocol ftp 21

ip address outside

ip address inside

global (outside) 1

nat (inside) 1 0 0

static (inside,outside) tcp ftp ftp netmask 0 0

What I do not understand is how to do this if you are pulling your ip via DHCP from the outside. Or with PIX 501 out of box config. How do you setup this whole sequence without giving an outside interface IP but rather just the outside interface as your point of exit and entry, then have that redirected to the inside machine of choice. The problem with the above sequence is once every 2 weeks or so my ISP changes my DHCP address so even if I do get it going with the above commands I would have to revert back to using dhcp setrout and then re-enter the configs again with the new IP. I would just like to start off by getting FTP running on an inside machine and having it accessible from the outside world. I am running Cisco PIX Firewall Version 6.1(2). Any help would be greatly appreciated. Thanks.

New Member

Re: PIX 501 Help Please!!!!!


Just saw a config that did this by substituing the keyword 'interface' in for the ip addresses you have configured... ie:

global (outside) 1 interface


static (inside,outside) tcp interface ftp ftp ...

I think that's your ticket. Hope it helps!


New Member

Re: PIX 501 Help Please!!!!!

Here is my current Config that I have right now on my pix. I tried putting what you told me in there and then someone else told me about an access-list , group I should try. First I tried just what you told me. Then I tried both of these separately and then together and no go. I now included both of them so you could see what I have so far and maybe be able to tell me what I may be doing wrong. Thank you very much for your time.

PIX Version 6.1(2)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password blah blah blah

passwd blah blah blah

hostname blah

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000


access-list fromoutside permit tcp any host eq ftp

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0 0

static (inside,outside) tcp interface ftp ftp netmask 255.255.255.

255 0 0

access-group fromoutside in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet timeout 5

ssh timeout 5

dhcpd address inside

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80


New Member

Re: PIX 501 Help Please!!!!!

I can point out that the access-list is incorrect, as for the exact syntax or if this can be done or not...I'm not sure. Right now, you access-list is pointing to the local address (, it should be pointing to the global address, which in this case, the outside interface.

I think the syntax should be something like this:

access-list fromoutside permit tcp any host 'outside-interface' eq ftp

I don't think the PIX is gonna take this though.

New Member

Re: PIX 501 Help Please!!!!!

You need to have a static public IP address for the outside interface of the pix inorder to host any kind of server that is to be accessed from the internet. Without this no one could find your site and connect to it. Ask your ISP if they have a way arround this.

New Member

Re: PIX 501 Help Please!!!!!

Thanks a lot for helping out. I have been so swamped with work of late that I havent been on her for a day or two. I will try all the suggestions on my PIX tonight. Again thank you guys very much for your input.

CreatePlease to create content