Hi,
i don't understand why this can not be done.
i have a cisco pix 515 with a pool of static IP addresss (14IPs) assigned by ISP. My internal network is 10.10.0.0/24. the pix has 2 interfaces. web and ssh traffic from outside to internal web/ssh server is fine. internal client have no problems accessing the internet.
i have nagios clients NRPE installed on the internal network and nagios monitor server installed outside of the pix firewall. i would like to allow the nagios server to monitor the server behind the firewall. to save IPs, i am using 1 static IP address for mapping and use it to port forward to all internal IP addresses at 5666. for testing, i telnet from outside the firewall to x.x.x.146 x.x.x.147 port 5666 5667
5668 5669 all fails except to port 5666 on x.x.x.147.here is my current config. any help would be greatly appreciated!
g.
mypix# show run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password xQIfy7TWQw.w encrypted passwd T7Jj6BURLPDx encrypted hostname mypix domain-name cisco.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list 100 permit icmp any any echo-reply access-list 100 permit icmp any any time-exceeded access-list 100 permit tcp any host x.x.112.147 eq www access-list 100 permit tcp any host x.x.112.147 eq ssh access-list 100 permit tcp any host x.x.112.147 eq 5666 access-list 100 permit tcp any host x.x.112.147 eq 5667 access-list 100 permit tcp any host x.x.112.147 eq 5668 access-list 100 permit tcp any host x.x.112.147 eq 5669 access-list 100 permit tcp any host x.x.112.146 eq 5666 access-list 100 permit tcp any host x.x.112.146 eq 5667 access-list 100 permit tcp any host x.x.112.146 eq 5668 access-list 100 permit tcp any host x.x.112.146 eq 5669 access-list split permit ip 10.10.0.0 255.255.255.0 10.1.2.0
255.255.255.0 access-list nonat permit ip 10.10.0.0 255.255.255.0 10.1.2.0 255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside x.x.112.146 255.255.255.240 ip address inside 10.10.0.254 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool poolclient 10.1.2.1-10.1.2.254 pdm location 10.10.0.0 255.255.255.0 inside pdm history enable arp timeout 14400 global (outside) 1 x.x.112.150-x.x.112.157 global (outside) 1 interface global (outside) 1 x.x.112.158 nat (inside) 0 access-list nonat nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) x.x.112.147 10.10.0.101 netmask 255.255.255.255 0 0 static (inside,outside) tcp interface 5666 10.10.0.103 5666 netmask 255.255.255.255 0 0 static (inside,outside) tcp interface 5667 10.10.0.104 5666 netmask 255.255.255.255 0 0 static (inside,outside) tcp interface 5668 10.10.0.105 5666 netmask 255.255.255.255 0 0 static (inside,outside) tcp interface 5669 10.10.0.106 5666 netmask 255.255.255.255 0 0 access-group 100 in interface outside route outside 0.0.0.0 0.0.0.0 x.x.x.145 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 10.10.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set myset esp-des esp-md5-hmac crypto dynamic-map dynmap 10 set transform-set myset crypto map mymap 10 ipsec-isakmp dynamic dynmap crypto map mymap client configuration address initiate crypto map mymap client configuration address respond crypto map mymap client authentication LOCAL crypto map mymap interface outside isakmp enable outside isakmp identity address isakmp nat-traversal 20 isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup vpn3000 address-pool poolclient vpngroup vpn3000 dns-server x.x.x.1 vpngroup vpn3000 split-tunnel split vpngroup vpn3000 idle-time 1800 vpngroup vpn3000 password ******** telnet x.x.x.253 255.255.255.255 outside telnet 10.10.0.0 255.255.255.0 inside telnet timeout 5 ssh x.x.115.0 255.255.255.0 outside ssh 0.0.0.0 0.0.0.0 outside ssh 10.10.0.0 255.255.255.0 inside ssh timeout 5 console timeout 0 username x01 password zyjVE5 encrypted privilege 2 username x03 password Vct8HaSB encrypted privilege 2 username x2 password hXVsT encrypted privilege 2 username x5 password . szmqxT encrypted privilege 2 username x4 password tUTLfiAnl encrypted privilege 2 username x7 password fJst049 encrypted privilege 2 username x8 password SqKcA/Nc encrypted privilege 2 username x9 password JMOSfRm7mx encrypted privilege 2 username x8 password kTTR8uWaa encrypted privilege 2 terminal width 80 Cryptochecksum:e65b29b7262d0c17d8610ec75d9351b6 : end