Pix 506e w/5 static outside IPs - How to create a rule to allow ALL tcp/udp traffic from one outside IP to an internal IP (for an internal router/NAT with it's own subnet)

Aceman · 2008-04-06T19:39:10+00:00

I know this may be a simple task, but I'm having a little trouble figuring it out. I am no expert at PIX ACLs, but when I need something, I google it, read up on it and adapt what I find to what I need and eventually getting it working. I've already configured internal mail and web services to work from the outside world. However I'm having a little difficulty wtih this one.Scenario and requirements:I have a Business FIOS 5 IP static line at home. I wanted to get the double-play (TV and phone) on the line. They first said you can't do it with a static line, but then I got someone else who said I can, but I need to use up one of my IPs. No problem I said, but I added how will I configure that through a PIX 506e? They said you can't and need their provided POS Actiontec, which I still have in the closet. They said pick one of the IPs and send ALL traffic to the Actiontec plugged into your current network. Create a private network with the Actiontec and the TV boxes will plug into that subnet. Cool, thought this should be a cinch. But having trouble setting it up. Not sure how to allow ALL traffic from the one external IP to the IP configured on the Actiontec's "external" interface.I have a PIX 506e IOS version 6.3(5).Names created (using x.x.x.x as one of my external IPs):name 192.168.50.200 FIOSTV-Insidename x.x.x.x FIOSTV-Outside(Funny when I created the names, they didn't show up in the PDM. Did I do something wrong?)I'm thinking to try:static (inside,outside) udp FIOSTV-Outside any FIOSTV-Inside any netmask 255.255.255.255 0 0static (inside,outside) tcp FIOSTV-Outside any FIOSTV-Inside any netmask 255.255.255.255 0 0access-list outside_access_in permit tcp any host FIOSTV-Outside eq anyaccess-list outside_access_in permit udp any host FIOSTV-Outside eq anyOr should I create a group for tcp-udp defining ports 1-65536 and allow it by the group name? But I thought this would be over-doing it because a simple 'any' would work?If I forgot anything concerning or if you...

Apr 06, 2008 22 Replies

Rate this thread:

sylvek 18 years ago

Hi Walter!

I'm just writing to thank you for your time to compose the reply to my question. I really appreciate this.

I'll probably need to create a separate folder to store your posts to comp.dcom.sys.cisco, the same thing that I had before for your posts to comp.sys.sgi.*.

Thanks again,

Sylvek

Vote