Cisco Support Community
Community Member

port redirection on 501

I have a PIX 501 connected to broadband connection. I want to provide web/ftp services froma server on the internal network. I have setup port redirection, ACL's, and NAT per TAC docs, but I can not connect to the services. Thank you and here's the config.

PIX Version 6.1(3)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514


access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-list 101 permit icmp any any echo-reply

access-list 102 permit tcp any any eq ftp

access-list 102 permit tcp any any eq www

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0 0

static (inside,outside) tcp interface ftp ftp netmask 0 0

access-group 102 in interface outside

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http inside

Cisco Employee

Re: port redirection on 501

Obviously you'd need a similar static command for the www redirection.

Other than that the config looks OK, what do you get whne you try and connect either with FTP or HTTP. Enable syslogging on the PIX with:

> logging on

> logging buffer debug

Then try a connection and do a "sho log" to see what the syslog shows. This will give you the best indication of what's going wrong. If you see nothing in the log, then check with your ISP to see if they're filtering all the low port numbers out, some ISP's don't want you running web servers unless you pay extra.

Community Member

Re: port redirection on 501

I fixed it! My ACL's were wrong becuase my FTP was not on port 21. I thought I could use 'ftp' in my ACL b/c I had changed the port with fixup.I could not (and still can't) view my website on my public IP, but the rest of the world can. I remember reading something about this being normal, but it's not a huge deal anyway. I really appreciate you looking in to this. Thanks again for your help.

Cisco Employee

Re: port redirection on 501

Glad to hear it's working.

If you want to browse to your web site using it's public address, try adding the "dns" option to your port 80 static command. See for details.

Or you can use the "alias" command, but this has been superceded by the static dns option I described above. The alias command also limits your ability to use PDM, but here are its details anyway:

Community Member

Re: port redirection on 501

Great, I'll try it and thanks for your help.

CreatePlease to create content