Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Pix question

I want to add another global outside ip address in pix firewall for outlook web server, basically i want to seperate exchange server and outlook web in different machines, outlook web & exchange Servers are intsalled inside the network, I also want alow outside users to access their e-mails connecting with any internet provider thru outlook web, so this would be like this???

static (inside,outside) 212.x.x.10 netmask 0.0 (is this correct)

conduit permit tcp host any

conduit permit tcp host 212.x.x.10 any

Please help!!!

New Member

Re: Pix question

This is what you can do. Have a static and conduit pair for each server. If your exchange server was and your outlook web server was, then do this:

static (inside,outside) 212.X.X.10

static (inside,outside) 212.X.X.11

conduit permit tcp host 212.X.X.10 eq (protocol) any

conduit permit tcp host 212.X.X.11 eq (protocol) any

The (protocol) would be smtp, http, etc., whatever you want to permit to get to that server.

New Member

Re: Pix question

Thanks for your reply, just a quick question, Is it really require to restart the pix firewall to take effect the new settings??

another question is defining static map for INSIDE/DMZ/OUTSIDE should be in sequence or it does not mater whatever sequence you make.

for example

static (inside,outside) 212.x.x.10 netmask 0.0

static (inside, DMZ)

static (inside)

static (inside,outisde)

see above it is not in sequence i have the same case, I applied the settings you have suggested but it is not even ping to that IP from outside ...

please suggest!!!

New Member

Re: Pix question

The pix will allow outbound icmp packets from a higher security interface to a lower security interface, as long as you have a translation. In your case, if the static (inside, outside) statement is correct, then it will allow the echo request to go out.

The echo reply (the response to your ping) will, by default, be dropped by the pix. To allow it to return, you will need to apply a conduit or an ACL specifically permitting it.

For test purposes, you can apply a conduit permit icmp any any.

I recommend that you refer to the command reference for further clarification of the use of the commands.

Hope this helps


CreatePlease login to create content