[lug] OT: Cisco PIX
timothy.schuler at attbi.com
Thu Oct 17 19:40:17 MDT 2002
In your access-list don't use the <internal host> as the destination -
use the <ext_ip> you defined in the static command.
After you make changes to an acl or to NAT make sure you always do a
'clear xlate' to flush the translation table buffer.
Make sure this part of the access-list is getting hit when you try and
go to the web server from an outside address by issuing a 'show
access-list acl_out' command. The 'hitcnt' counter should be
incrementing - if it doesn't there is still a problem with your acl.
Here is a decent reference for 'inside' / 'outside' PIX configuration
using NAT. Beware of url wrapping.
TJ Schuler, CCIE #8800
Coleman Technologies, Inc.
720-981-4276 Office Phone
720-339-6000 Cell Phone
> -----Original Message-----
> From: lug-admin at lug.boulder.co.us
> [mailto:lug-admin at lug.boulder.co.us] On Behalf Of Hugh Brown
> Sent: Thursday, October 17, 2002 2:46 PM
> To: LUG
> Subject: [lug] OT: Cisco PIX
> I am struggling with getting a Cisco PIX firewall (501) to
> redirect web traffic on the outside interface to a specific
> host on the inside interface.
> Under linux I would do this:
> ipmasqadm portfw -a -P tcp -L <ext ip> 80 -R <internal host> 80
> ipchains -A input -i $EXTERNAL_INTERFACE -p tcp \
> -s <remotehost> $UNPRIVPORTS \
> -d <ext ip> 443 -j ACCEPT -l
> ipchains -A output -i $EXTERNAL_INTERFACE -p tcp ! -y \
> -s <ext ip> 443 \
> -d <remote host> $UNPRIVPORTS -j ACCEPT -l
> I have tried the following on the pix
> static (inside,outside) <ext ip> <internal host> netmask
> 255.255.255.255 0 0 access-list acl_out permit tcp host
> <remote host> gt 1024 host <internal
> host> eq 80
> access-group acl_out in interface outside
> and I get:
> 106023: Deny tcp src outside:<remote host>/40623 dst
> inside:<ext ip>/80 by access-group "acl_out"
> What am I doing wrong?
> Web Page: http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> Join us on IRC: lug.boulder.co.us port=6667 channel=#colug
More information about the LUG