Cisco PIX 501 port forwarding trouble
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
|||||||||||||
|
Posted by on September 24, 2006, 10:32 am
Please log in for more thread options Im trying to forward http traffic from my outside dsl interface to inside http server but it doesnt work. I get nothing about the forwarding in the log and the connection just closes when i try to access my webserver form the outside. I have been fiddling around with this for a few hours now and im not feeling any more lucky after trying google. This is my config at the moment: Building configuration... : Saved : PIX Version 6.3(3) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password * encrypted passwd * encrypted hostname pix domain-name maciekish.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.1.100 Mainframe access-list outside_access_in permit tcp host XXX.XXX.XXX.XXX eq www host Mainframe eq www pager lines 24 logging on mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.1.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location Mainframe 255.255.255.255 inside pdm location XXX.XXX.XXX.XXX 255.255.255.255 outside pdm location 85.226.42.0 255.255.254.0 outside pdm logging debugging 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (outside,inside) tcp Mainframe www XXX.XXX.XXX.XXX www netmask 255.255.255.255 0 0 static (inside,outside) Mainframe Mainframe netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.129 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside dhcpd enable inside terminal width 80 Cryptochecksum:3501796baa4656a6b0bc05cfd7a8f4a4 : end [OK] | |||||||||||||
|
Posted by none on September 24, 2006, 12:32 pm
Please log in for more thread options Use these instead: name 192.168.1.100 Mainframe access-list outside_access_in permit tcp any interface outside eq www static (inside,outside) tcp interface www Mainframe www netmask 255.255.255.255 0 0 | |||||||||||||
|
Posted by maciekish on September 25, 2006, 6:05 am
Please log in for more thread options
none wrote: > On Sun, 24 Sep 2006 07:32:15 -0700, maciekish wrote:
> > > name 192.168.1.100 Mainframe
> > access-list outside_access_in permit tcp host XXX.XXX.XXX.XXX eq www > > host Mainframe eq www > > static (outside,inside) tcp Mainframe www XXX.XXX.XXX.XXX www netmask > > 255.255.255.255 0 0 > > static (inside,outside) Mainframe Mainframe netmask 255.255.255.255 0 0 >
> > Use these instead: > > name 192.168.1.100 Mainframe > access-list outside_access_in permit tcp any interface outside eq www > static (inside,outside) tcp interface www Mainframe www netmask > 255.255.255.255 0 0 thanks for a quick response but it still doesnt work. here is the PDM log when trying to connect to the web server. http://img95.imageshack.us/my.php?image=pixfx7.jpg in the log i noticed that external:80 is trying to translate to mainframe:3389 or something like that. shouldnt it be external:xxxx to mainframe:80 ? | |||||||||||||
|
Posted by maciekish on September 25, 2006, 6:42 am
Please log in for more thread options let me just clarify that my webserver works if i port forward from a
netgear instead of the pix so the problem is only the pix configuration as i am upgrading from the netgear. | |||||||||||||
|
Posted by none on September 25, 2006, 7:19 am
Please log in for more thread options On Mon, 25 Sep 2006 03:05:21 -0700, maciekish wrote:
>
> none wrote: >> On Sun, 24 Sep 2006 07:32:15 -0700, maciekish wrote:
>> >> > name 192.168.1.100 Mainframe
>> > access-list outside_access_in permit tcp host XXX.XXX.XXX.XXX eq www >> > host Mainframe eq www >> > static (outside,inside) tcp Mainframe www XXX.XXX.XXX.XXX www netmask >> > 255.255.255.255 0 0 >> > static (inside,outside) Mainframe Mainframe netmask 255.255.255.255 0 0 >>
>> >> Use these instead: >> >> name 192.168.1.100 Mainframe >> access-list outside_access_in permit tcp any interface outside eq www >> static (inside,outside) tcp interface www Mainframe www netmask >> 255.255.255.255 0 0 >
> thanks for a quick response but it still doesnt work. here is the PDM > log when trying to connect to the web server. > http://img95.imageshack.us/my.php?image=pixfx7.jpg > > in the log i noticed that external:80 is trying to translate to > mainframe:3389 or something like that. shouldnt it be external:xxxx to > mainframe:80 ? Did you remove all of your statements that I showed above mine? Did you do a "clear xlate" after that? Can your webserver browse the Internet through the PIX? | |||||||||||||
| Similar Threads | Posted |
| Cisco PIX 501 port forwarding trouble | September 24, 2006, 10:32 am |
| Port Forwarding with Cisco 871?? | September 25, 2005, 12:58 pm |
| cisco pix 515 port forwarding - NOT possible? hard to believe.. | July 27, 2005, 12:23 am |
| Cisco 871 router port forwarding | July 12, 2006, 8:41 pm |
| port mapping or forwarding on Cisco Pix 506E | August 5, 2005, 1:30 pm |
| Port forwarding from cisco 2600 to ASA-5510 | July 20, 2006, 10:23 am |
| Port Forwarding / VPN Pass-Thru on a Cisco 2800 | August 30, 2006, 3:20 pm |
| Cisco 2600 + DSL + Cable -> Failover and port forwarding | July 2, 2008, 12:47 am |
| Port forwarding | February 2, 2006, 3:05 pm |
| Port forwarding help? | June 4, 2006, 10:23 pm |
| Need help Port forwarding on PIX 501 | September 14, 2006, 9:18 am |
| Port 21 forwarding on PIX 501 | September 15, 2006, 11:56 pm |
| PIX Port Forwarding | November 15, 2006, 2:42 pm |
| port forwarding | December 13, 2006, 9:39 am |
| Port Forwarding | October 7, 2008, 9:36 am |
> access-list outside_access_in permit tcp host XXX.XXX.XXX.XXX eq www
> host Mainframe eq www
> static (outside,inside) tcp Mainframe www XXX.XXX.XXX.XXX www netmask
> 255.255.255.255 0 0
> static (inside,outside) Mainframe Mainframe netmask 255.255.255.255 0 0