Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

PIX 501 Port Redirection

Ok I have been through every thread on this forum and have found this same question posed several times but no answers seem to work for what I have currently and I never saw anyone say "Hey that worked" so I am posting it again......I know how to do port redirection on a static route on the PIX 501 or at least in theory how to do it(209.x.x.x being the outside interface and 10.x.x.x being the inside:

fixup protocol ftp 21

ip address outside

ip address inside

global (outside) 1

nat (inside) 1 0 0

static (inside,outside) tcp telnet telnet netmask 0 0

static (inside,outside) tcp ftp ftp netmask 0 0

static (inside,outside) tcp telnet telnet netmask 0 0

What I do not understand is how to do this if you are pulling your ip via DHCP from the outside. Or with PIX 501 out of box config. How do you setup this whole sequence without giving an outside interface IP but rather just the outside interface as your point of exit and entry, then have that redirected to the inside machine of choice. The problem with the above sequence is once every 2 weeks or so my ISP changes my DHCP address so even if I do get it going with the above commands I would have to revert back to using dhcp setrout and then re-enter the configs again with the new IP. I would just like to start off by getting FTP running on an inside machine and having it accessible from the outside world. I am running Cisco PIX Firewall Version 6.1(2). Any help would be greatly appreciated. Thanks.

Community Member

Re: PIX 501 Port Redirection

If I understand you correct, and to keep it simple :

Users on the outside are not able to connenct to your FTP because the outside address of the PIX changes from time to time..???

Assuming I got this correct, and also assumng that the outside interface allocates it address with some kind of DHCP, the 6.2 version (I know you are running 6.1, so you might have to upgrade) supports in the STATIC statement a reference to a dynamic IP address. So in your case I guess this would do the trick:

static (inside,outside) tcp OUTSIDE ftp ftp netmask


Good luck


Community Member

Re: PIX 501 Port Redirection

I take that back,.... I misunderstood the documentation, however You might want to try

static (inside,outside) tcp INTERFACE ftp ftp netmask

... but I'm not sure on this one....

Sorry :-(

CreatePlease to create content