Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Static Translation Problems

We have an internet connection from a pix 515e via a leased line router.

the users can access the internet no problem and also we can get people accessing our web server but we have no outbound or inbound email.

we have our own internal email server.

out internal email server is set to 192.168.1.3 and we have a static command in the pix to say

static (inside,outside) 1.1.1.1 192.168.1.3

(1.1.1.1 has been changed for security purposes)

so the real world address for out mail server is 1.1.1.1 and this is translated to 192.168.1.3 this does not work, no email at all.

but, we have a web server 1.1.1.2 real world address which gets translated to 192.168.1.11 and this works without any problems.

outbound internet is also working perfectly.

please see our config below.

: Saved

:

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

enable password xxxxx

passwd xxxxx

hostname TheWall

domain-name xxx.com

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list 101 permit tcp any host 1.1.1.1 eq smtp

access-list 101 permit tcp any host 1.1.1.2 eq www

access-list 101 permit tcp any host 1.1.1.2 eq login

access-list 101 permit icmp any any

access-list 101 permit icmp any any echo

access-list 101 permit icmp any any echo-reply

pager lines 24

logging on

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside 1.1.1.10 255.255.255.0

ip address inside 192.168.1.10 255.255.255.0

no ip address intf2

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

global (outside) 1 interface

access-group 101 in interface outside

conduit permit icmp any any

conduit permit udp any any

route outside 0.0.0.0 0.0.0.0 1.1.1.100

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:xxxxxxx

: end

  • Other Security Subjects
18 REPLIES
Gold

Re: Static Translation Problems

Hi Chris,

Have a read of the following document and let me know if it helps or if you need further assistance:

> http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094466.shtml

Regards - Jay.

New Member

Re: Static Translation Problems

Hi Jay,

Thanks for the web link but this is nearly the same as what we have.

we have the static commands in and the access-lists required.

the nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

these 2 statements are need as we are associating everything that goes outbound to the internet to the outside interface as we can only use this address and the other outside address are taken up by www,mail and other servers.

can you please help.

regards

chris

Gold

Re: Static Translation Problems

Hi Chris,

static (inside,outside) tcp smtp smtp netmask 255.255.255.255 0 0

access-list mail_in permit tcp any host eq smtp

access-group mail_in in interface outside

Remember to execute command clear xlate after the modifications and save with command write memory.

Hope this sorts out your problem and let me know how you get on.

Jay.

New Member

Re: Static Translation Problems

i tried this but did not work, it works for the www address but not the smtp

Gold

Re: Static Translation Problems

Chris -

Forgot to add on my previous post, try adding the following command on the config:

> no fixup protocol smtp 25

Let me know your outcome.

Jay.

New Member

Re: Static Translation Problems

can you ping the smtp box from the pix:

pix1# ping inside 192.168.1.3

1. what is the gateway set for the smtp server? (shld be inside IP of PIX)

2. can the www box telnet to port 25 on the smtp box?

3. can you ping from the smtp box to the inside interface of the pix?

4. If yes to the above then check your ACE in the ACL for smtp , is there any count on that is it increasing when you try to access it from the ouside in?

5. If not then you have an ACL issue somewhere maybe. use "debug icmp trace" on the pix w/o the "" and see where the packet is going.

This should point you in the right direction to solve the problem.

- Jeff

New Member

Re: Static Translation Problems

Did you solve this problem? I am having the same problem with my Mail server and PIX. Do you have to have a static (inside,outside) translation for your Mail server?

New Member

Re: Static Translation Problems

hi,

no this did not solve my problem and i am still having major issues.

The config has a static (inside,outside) translation but yet this is not working for my mail server.

have you the same issue as well and have you managed to get round this

Gold

Re: Static Translation Problems

Hi Chris,

Can you post your PIX config to me at jmia@ohgroup.co.uk and please remember to change real IPs and passwords etc.

And did you try the no fixup smtp as I suggested earlier? make sure to clear translations with clear xlate after static or ACL modifications.

Jay.

274
Views
0
Helpful
18
Replies