1. Home
  2. Cisco Systems
  3. Object-group help on PIX 501

Object-group help on PIX 501

Can someone help me to make an "access-group" command that will allow all the services specified in "sbs2003" object-group to be open? Is my access-list command correct???

I want to forward those service-ports to my mail/web server on the inside -

192.168.1.1

Thanks.

Note: xxx.xxx.xxx.xxx is public IP.

PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password Y7EKFZ/WwxR3Oz37 encrypted passwd Y7EKFZ/WwxR3Oz37 encrypted hostname pix-sf domain-name secret.local clock timezone PST -8 clock summer-time PDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 no fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 no names name 192.168.3.0 NYOffice name 192.168.1.0 SFOffice name 192.168.1.1 server1 object-group service SBS2003 tcp port-object eq 4125 port-object eq www port-object eq 3389 port-object eq 444 port-object eq https port-object eq smtp access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0

192.168 .3.0 255.255.255.0 access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 access-list outside_access_in permit tcp interface outside object-group SBS2003 host xxx.xxx.xxx.xxx object-group SBS2003 pager lines 200 mtu outside 1500 mtu inside 1500 ip address outside xxx.xxx.xxx.xxx 255.255.255.248 ip address inside 192.168.1.254 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 192.168.3.0 255.255.255.0 outside pdm location 192.168.1.1 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface smtp 192.168.1.1 smtp netmask 255.255.255. 255 0 0 route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx (ISP gateway) 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local ntp server 192.168.1.254 source inside prefer http server enable http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps tftp-server inside 192.168.1.1 /pix floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer 67.102.218.146 crypto map outside_map 20 set transform-set ESP-3DES-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address zzz.zzz.zzz.zzz netmask 255.255.255.255 no-xauth no-c onfig-mode isakmp nat-traversal 20 isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 telnet 0.0.0.0 0.0.0.0 inside telnet timeout 60 ssh 0.0.0.0 0.0.0.0 outside ssh xxx.xxx.xxx.xxx 255.255.255.255 outside ssh 192.168.1.0 255.255.255.0 inside ssh 0.0.0.0 0.0.0.0 inside ssh timeout 30 management-access inside console timeout 0 dhcpd address 192.168.1.2-192.168.1.129 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80 Cryptochecksum:1f3cfd9bf54c9d4d3afaeb11fbf3aef6 : end
Reply to
Ian McKellan
Loading thread data ...

In article , Ian McKellan wrote: :Can someone help me to make an "access-group" command that will allow all :the services specified in "sbs2003" object-group to be open? :Is my access-list command correct???

host xxx.xxx.xxx.xxx object-group SBS2003

Change those to

access-list outside_access_in permit tcp any interface outside object-group SBS2003 access-list sbs2003_static_acl permit tcp host 192.168.1.1 any static (inside,outside) interface access-list sbs2003_static_acl

The way you had the ACL configured would have been for the case (impossible without spoofing) where the outside interface IP was the source and the public IP xxx.xxx.xxx.xxx was the destination, and both the source -and- destination ports were chosen from the SBS2003 object (e.g., source port 4125, destination port smtp.)

Your static was along the right lines, but you had only static'd the one port and needed to static the others as well. As you already had constructed the SBS2003 object it was easier to use that in a "policy static" than to put together a bunch of individual 'static' statements.

no-config-mode

Not much point concealing zzz.zzz.zzz.zzz when you left it visible in your 'set peer' statatement ;-)

Reply to
Walter Roberson

again ? I replied this the same Q in your other tread: Open up ssh for remote access on PIX 501

9th jan ...

please read that first

Reply to
Martin Bilgrav

Giving that the IP you use for mapping is the same as the outside interface IP:

object-group service SBS2003 tcp port-object eq 4125 port-object eq www port-object eq 3389 port-object eq 444 port-object eq https port-object eq smtp no access-list outside_access_in access-list outside_access_in permit tcp any interface outside object-group SBS2003 access-group outside_access_in in interface outside

sho access-list outside_access_in should then give this result:

access-list outside_access_in; 6 elements access-list outside_access_in line 1 permit tcp any interface outside object-group SBS2003 access-list outside_access_in line 1 permit tcp any interface outside eq

4125 (hitcnt=0) access-list outside_access_in line 1 permit tcp any interface outside eq www (hitcnt=0) access-list outside_access_in line 1 permit tcp any interface outside eq 3389 (hitcnt=0) access-list outside_access_in line 1 permit tcp any interface outside eq 444 (hitcnt=0) access-list outside_access_in line 1 permit tcp any interface outside eq https (hitcnt=0) access-list outside_access_in line 1 permit tcp any interface outside eq smtp (hitcnt=0)
Reply to
Martin Bilgrav

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.