1. Home
  2. Cisco Systems
  3. Qwest Private Network & Pix

Qwest Private Network & Pix

I've got a scenario in which I'm trying to install a Pix 501 at a site that is connected to other sites via a Qwest PRN (private network) VPN.

Currently they provide firewall service on an edge router, but had turned this off so I could install a Pix. I was able to get the Pix fully functional except for one issue. I could not seem to figure out how to allow the other branch offices with private IPs in through the outside interface of the Pix.

Basically, the site in which I'm installing the Pix, has it's internal interface configured with 192.168.0.1 and the outside interface as 65.x.x.x. The Cisco 1720 router in front of the Pix routes public internet traffic as well as private network traffic from 3 other sites (192.168.1.0/24,

192.168.2.0/24,192.168.3.0/24). I added a route to the 1720 so that all 192.168.0.0 255.255.0.0 traffic routes to the Pix. But the traffic stops at the Pix, and I'm not sure what I've got wrong, or am missing. In order to allow the traffic through the Pix, I used the following statement:

access-list 110 permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.255.0 various other access list commands... access-group 110 in interface outside

All the other access-list statments for allowing public ports inside work fine.

All traffic from the 192.168.0.0/24 network to all the other private networks also works fine.

But no other private networks can get through the Pix.

Can anyone offer any suggestions? Is the access-list statement correct? Is there some other way to accomplish this?

One other note. This has nothing to do with IPSec tunnels, or Pix to Pix traffic.

Thanks.

Reply to
Max Kipness
Loading thread data ...

Hi,

Did you exempt the traffic to 192.168.(1/2/3).0/24 from NAT. If not, then add these networks to the nat-0 list.

Erik

Reply to
Erik Tamminga

Erik, thanks for the response.

No I did not have a nat 0 statement in my configuration.

Currently without the nat 0 statement, traffic can get from the 192.168.0.0 network to any of the remote networks, ie 192.168.1/2/3.0 without problem. It's traffic from these other networks that cannot get to 192.168.0.0.

But are you saying that the traffic from the remote networks is getting to the pix and then when returning are being translated and lost?

I did some reading of the Pix command reference and I'm wondering if this would be the correct changes to make to solve my issues:

access-list 110 permit ip 192.168.0.0 255.255.0.0 any access-group 110 in interface outside

access-list no-nat permit ip 192.168.0.0 255.255.0.0 any nat (inside) 0 access-list no-nat

Any further help would be appreciated!

Thanks, Max

Reply to
Max Kipness

From inside to outside is (actually patted) natted by your nat(1) rule. This implicitly allows you to go to the other 192.168.0.0 networks. For the remote networks to get to the inside network you need to define a nat exemption and allow the traffic to enter via the outside interface.

Your proposal below isn't completely right. Because your inside network is a

192.168.x.x. network that matches your nat-0 rule, nat will not occur for any address, including the internet. You need to be more precise in your nat-0 list. I'd start with the following list:

access-list no-nat permit ip 192.168.0.0 255.255.255.0 192.168.1.0

255.255.255.0 access-list no-nat permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list no-nat permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0 nat (inside) 0 access-list no-nat

I'd do the same with the outside access in access-list (110). Be more precies in this list as well. Only permit traffic from 192.168.1.0,

192.168.2.0 and 192.168.3.0 destined to 192.168.0.0/24 to enter the outside interface.

Erik

Reply to
Erik Tamminga

Erik,

I appreciate your help. It ended up working great.

Thanks, Max

Reply to
Max Kipness

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.