Cisco Support Community
Community Member

PIX 506 doesn't work with STATIC entry


We got a couple PIX all running 6.3(1). For some strange reason on one of them I can not create a static translation for a server (http). As soon as I enter the static-command the server is unable to get onto the internet and is also invisible to the internet. In other words the static doesn't create what it should - it just breaks the servers connection to the internet.

I got the same commands running on a different box and they work there (www, smtp, and so on).

relevant commands:


nat (inside) 1 0 0

global (outside) 1 interface

access-list ACL_OUT permit tcp any host eq www

static (inside,outside) netmask 0 0

Thanks for any help

Cisco Employee

Re: PIX 506 doesn't work with STATIC entry

Sounds like your ISP hasn't allocated or routed to you correctly. When you add this static in, any outbound traffic from this web server is going to be changed to when that traffic returns, if your ISP is not routing that IP address to you properly then the packets aren't going to get to you. Check with them and make sure they've got everything set up correctly for that IP address.

Community Member

Re: PIX 506 doesn't work with STATIC entry

I have pluged a pc directly onto the outside router and set the IP to - as expected it worked. With the firewall I can even ping the ip. When I remove

access-list ACL_OUT permit icmp any any

then it stops responding to pings.

So it responds to pings although the box is not able to connect to the internet?!

I've never had a Pix play such games on me. This is usually a 2 minute job... (static then access-list).

Cisco Employee

Re: PIX 506 doesn't work with STATIC entry

OK, good testing.

I can telnet to on port 80 from here and I get connected, so if this is currently behind the PIX then the IP connectivity sems to be working OK. However, web browsing from here doesn't show up anything.

We really need to see the syslogs on the PIX to see what's going on. Do the following:

> logging on

> logging buffer debug

then try a connection from the outside to this web server, and also try an outbound connection from this web server, then send us the log file.

Also, keep in mind that if you've had a PC on the outside at and then you move this behind the PIX, you will need to clear the ARP table on your outside router, since the ARP entry won't time out for 3 hours (on a Cisco router anyway).

Re: PIX 506 doesn't work with STATIC entry


try removing your static command and replace it with this one:

static (inside,outside) tcp www www netmask

Kind Regards,


static (inside,outside) tcp interface 80 $

Community Member

Re: PIX 506 doesn't work with STATIC entry

I connected today via SSH and changed the static command to:

static(inside,outside) interface

In that second I lost the SSH connection and was unable to reconnect.

Btw the ip is just fictous.

CreatePlease to create content