cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
878
Views
0
Helpful
18
Replies

Static Translation Problems

cmelbourne
Level 1
Level 1

We have an internet connection from a pix 515e via a leased line router.

the users can access the internet no problem and also we can get people accessing our web server but we have no outbound or inbound email.

we have our own internal email server.

out internal email server is set to 192.168.1.3 and we have a static command in the pix to say

static (inside,outside) 1.1.1.1 192.168.1.3

(1.1.1.1 has been changed for security purposes)

so the real world address for out mail server is 1.1.1.1 and this is translated to 192.168.1.3 this does not work, no email at all.

but, we have a web server 1.1.1.2 real world address which gets translated to 192.168.1.11 and this works without any problems.

outbound internet is also working perfectly.

please see our config below.

: Saved

:

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

enable password xxxxx

passwd xxxxx

hostname TheWall

domain-name xxx.com

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list 101 permit tcp any host 1.1.1.1 eq smtp

access-list 101 permit tcp any host 1.1.1.2 eq www

access-list 101 permit tcp any host 1.1.1.2 eq login

access-list 101 permit icmp any any

access-list 101 permit icmp any any echo

access-list 101 permit icmp any any echo-reply

pager lines 24

logging on

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside 1.1.1.10 255.255.255.0

ip address inside 192.168.1.10 255.255.255.0

no ip address intf2

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

access-group 101 in interface outside

conduit permit icmp any any

conduit permit udp any any

route outside 0.0.0.0 0.0.0.0 1.1.1.100

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:xxxxxxx

: end

18 Replies 18

jmia
Level 7
Level 7

Hi Chris,

Have a read of the following document and let me know if it helps or if you need further assistance:

> http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094466.shtml

Regards - Jay.

Hi Jay,

Thanks for the web link but this is nearly the same as what we have.

we have the static commands in and the access-lists required.

the nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

these 2 statements are need as we are associating everything that goes outbound to the internet to the outside interface as we can only use this address and the other outside address are taken up by www,mail and other servers.

can you please help.

regards

chris

Hi Chris,

static (inside,outside) tcp smtp smtp netmask 255.255.255.255 0 0

access-list mail_in permit tcp any host eq smtp

access-group mail_in in interface outside

Remember to execute command clear xlate after the modifications and save with command write memory.

Hope this sorts out your problem and let me know how you get on.

Jay.

i tried this but did not work, it works for the www address but not the smtp

Chris -

Forgot to add on my previous post, try adding the following command on the config:

> no fixup protocol smtp 25

Let me know your outcome.

Jay.

rgrcommo
Level 1
Level 1

can you ping the smtp box from the pix:

pix1# ping inside 192.168.1.3

1. what is the gateway set for the smtp server? (shld be inside IP of PIX)

2. can the www box telnet to port 25 on the smtp box?

3. can you ping from the smtp box to the inside interface of the pix?

4. If yes to the above then check your ACE in the ACL for smtp , is there any count on that is it increasing when you try to access it from the ouside in?

5. If not then you have an ACL issue somewhere maybe. use "debug icmp trace" on the pix w/o the "" and see where the packet is going.

This should point you in the right direction to solve the problem.

- Jeff

kholford
Level 1
Level 1

Did you solve this problem? I am having the same problem with my Mail server and PIX. Do you have to have a static (inside,outside) translation for your Mail server?

hi,

no this did not solve my problem and i am still having major issues.

The config has a static (inside,outside) translation but yet this is not working for my mail server.

have you the same issue as well and have you managed to get round this

Hi Chris,

Can you post your PIX config to me at jmia@ohgroup.co.uk and please remember to change real IPs and passwords etc.

And did you try the no fixup smtp as I suggested earlier? make sure to clear translations with clear xlate after static or ACL modifications.

Jay.

kholford
Level 1
Level 1

I think I just found my mistake. I won't know until I test it tonight. I forgot to change the default gateway on my mail server when I put in the new PIX.

kholford
Level 1
Level 1

Here what I think my other problem is. Users on the outside send e-mail to us at johndoe@co.rock.wi.us. From outside our network I did an nslookup on co.rock.wi.us and found that the address that came back was only the ip address of my outside interface. I didn't see the address I'm using to statically map a translation to my internal Mail server. Therefore I would need my ISP, who hosts my external DNS, to change the address for smtp traffic.

can you email your config please, change the real world addressing remember.

i want to compare it with mine , i am having issues still

daniel.kline
Level 1
Level 1

If this is a MS Exchange server, try using this command:

no fixup protocol smtp 25

MS Exchange uses ESMTP.

Thanks for that information, will come in very usefull.

what access-list lists did u have in place to get this working ???

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: