telnet access to console server (PIX problem)

You are missing: telnet 172.16.2.0 255.255.255.0 console which allows telnet connection from your console interface.

Doan

I am not trying to access PIX from console server. I am trying to TELNET console server which is connected to my internal Routers, Switches & Servers not PIX.

Ok here is the debug output

111008: User 'enable_15' executed the 'terminal mon' command. 609001: Built local-host console:172.16.2.3 305011: Built static TCP translation from console:172.16.2.3/23 to outside:***.***.***.201/23 302013: Built inbound TCP connection 140 for outside:***.***.***.170/1087 (***.***.***.170/1087) to console:172.16.2.3/23 (***.***.***.201/23) 1 in use, 12 most used

PAT Global ***.***.***.201(23) Local 172.16.2.3(23)

111009: User 'enable_15' executed cmd: show xlate pix(config)# pix(config)# pix(config)# xlate 302014: Teardown TCP connection 140 for outside:***.***.***.170/1087 to console:172.16.2.3/23 duration 0:01:06 bytes 0 Xlate Clear 305012: Teardown static TCP translation from console:172.16.2.3/23 to outside:***.***.***.201/23 duration 0:01:06 609002: Teardown local-host console:172.16.2.3 duration 0:01:06 111008: User 'enable_15' executed the 'clear xlate' command.

609001: Built local-host console:172.16.2.2

305011: Built static TCP translation from console:172.16.2.2/23 to outside:***.***.***.202/23 302013: Built inbound TCP connection 141 for outside:***.***.***.170/1088 (80.229.18.70/1088) to console:172.16.2.2/23 (***.***.***.202/23)

1 in use, 12 most used PAT Global ***.***.***.202(23) Local 172.16.2.2(23)

111009: User 'enable_15' executed cmd: show xlate

302014: Teardown TCP connection 141 for outside:***.***.***.70/1088 to console:172.16.2.2/23 duration 0:02:01 bytes 0 SYN Timeout

305012: Teardown static TCP translation from console:172.16.2.2/23 to outside:***.***.***.202/23 duration 0:02:06

My outside IP address is ***.***.***.203 255.255.255.224. my console servers are ***.***.***.201 & ***.***.***.202, which is part of same subnet. my subnet is ***.***.***.192 and brodcast is ***.***.***.223. so my my default gatway ***.***.***.197 also part of same address range.

as advised earlier i have removed PAT.

static (console,outside) ***.***.***.202 172.16.2.2 netmask

255.255.255.255 0 0 static (console,outside) ***.***.***.201 172.16.2.3 netmask 255.255.255.255 0 0

put in "logging moni deb" and in conf t mode give "term mon" during your telnet access tries.

I would not set up PAT when you have unique IPs, so remove the two static and add: static (console,outside) ***.***.***.202 172.16.2.2 netmask 255.255.255.255

0 0 static (console,outside) ***.***.***.201 172.16.2.3 netmask 255.255.255.255 0 0

Remember to give "clear xlate" whenever you make any changes, and observe your monitor output for any hints on what goes wrong. you might also want to look out for any builds that closes during timeout with no data in session, which would indicate that something else inbetween console interface and AccessServer that might block the telnet and FTP.

HTH Martin Bilgrav

also please make sure tyhat you telnet from the outside interface to the IP xxx.xxx.xxx.201 and .202, which I asumes are in the same range as your PIX outside interface.

HI Martin,

I don't think it is to do with console server and to prove i have done following tests;

1)I done this earlier as well. Assigned public IP 201 & 202respectively to both the console servers and changed default gateway to 197 and connected directly to switch which connects to my ISP and guess what i could telnet straightaway from any public IP.

2)One more test to prove nothing wrong with console server. I assigned ip address 172.16.2.5 and default g/w 172.16.2.1 to my laptop and connected directly to switch which connects PIX (console interface) & both the console servers. Then from laptop I manage to telnet console server . Next I configured PIX to accept telnet connection form console server and i could telnet PIX from console server as well. Which shows that there can't be 3way tcp handshake issue it could be something to do with STATIC translation ?

So this test proves that nothing wrong with console server it seems something is still missing in the pix config ? Agree???

Thanks,

Rits

302014: Teardown TCP connection 141 for outside:***.***.***.70/1088 to console:172.16.2.2/23 duration 0:02:01 bytes 0 SYN Timeout

tells you that there is SYN timeout in your 3way tcp handshake means that your server doesnt make the connection or the ACK packet never finds it way back to the PIX, and later the client

i.e. your problem is not your PIX cfg. Check service is running check routes on server (netstat -rnv) check filters inbetween server and pix interface.

HTH Martin

Check it. One of this is your problem.

"in the Wild" on the internet - This senario doesnt exclude any issues on your LAN. Just proves that your ISP works.

If you have gateway or routing problem or filterproblem, having a directly connected host does not test this.

No