https traffiic on a PIX 515

I typed the access-list from memory, not from having it in front of me. So I think I was in fact using 255.255.255.0. Because the PIX passes the www traffic just fine, also makes me think I'm using the

I'm still at a loss about the https traffic. Hmmm, ... I'm using https in the access-list because the destination port is 443. Does https depend on some other port in addition to port 443?

Thanks for you help.

B Squared

In article , wrote: :I've gotten most of the problems with my PIX 515 resolved, but I have :one remaining. I can get normal http (www) traffic to cross from a low :security interface (outside) to a higher security interface (inside) and :back. But I can't do the same for https traffic.

:Here's my access list. It's not very tricky. The idea is to permit :packets to the subnet where the www and https traffic is intended to go

: access-list web permit tcp any XXX.XXX.XXX.0 0.0.0.255 eq www : access-list web permit tcp any XXX.XXX.XXX.0 0.0.0.255 eq https : access-list web permit ip any any

The netmask is wrong for the PIX -- it should be 255.255.255.0 . The first two statements are effectively not going to be used, so it's down to the permit-everything third statement.

This doesn't explain why https isn't traversing your interface, though.

In article , wrote: :I'm still at a loss about the https traffic. Hmmm, ... I'm using https :in the access-list because the destination port is 443. Does https :depend on some other port in addition to port 443?

No.

I can't think offhand, though, of how https sidesteps the need for IP+port rewrites that are present in the http protocol. But then I have not ever really looked at how https works.

I am using static NAT, and addresses are mapped 1 to 1, so I don't think NAT is the problem. But thanks for the idea.

B Squared

What about static NAT statements? Because of that you haven't posted all the configuration I supposed you mapped an external address 1 to 1 to an internal one. Is it true or perhaps have you forwarded only port 80?

Alex.

Inorder for you to use ACL you also need a Static cmd to match the given server. Also for SSL, you need one public IP pr server/site.

So inorder for anyone to help you, you need to post your show static output. Also, ofcourse, you need to have a route statment to route traffic to the host. hth Martin Bilgrav