506e - Need help with configuration 1

[fraustbyte]

I'm not clear on the need to NAT or not to NAT. I am putting the PIX between my ISP and a number of web/ftp servers that need to be accessible to the public. These web/ftp servers will need to have outbound internet access as well.

Is this enough information for someone to tell me if I need to NAT or not? Can you tell me how it would be configured on the PIX?

I do want to use private IPs for the web servers and I have several public IPs provided by my ISP. I plan to use static mappings for inbound access to the web/ftp servers.

Any help would be appreciated.

 

[Supergrrover]

You should use NAT and only direct the ports that you want to those servers - less attack surface.

Here is the basic formula

Build Access List to allow the traffic in (one line for each port/IP pair)-
access-list outside_access_in permit tcp any host [ExternalIP/interface outside] eq [Port#]

Apply the ACL to the outside interface -
access-group outside_access_in in interface outside

Map incoming port to an IP and port on the inside (one line for each port/IP pair)-
static (inside,outside) tcp [ExternalIP/interface] [Port#] [InteralIP] [Port#] netmask 255.255.255.255



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[fraustbyte]

Thanks. In doing that will I be able, from the inside, to access anything externally? For example can browse the web from one of my web servers?

 

[fraustbyte]

Also in addition to the commands you provided do I need to use the "nat" command at all? Thanks

 

[Supergrrover]

Yes, you will need something like this

nat (inside) 1 0.0.0.0 0.0.0.0 - take all these networks on the inside and
global (outside) 1 interface - pat them to the source address of the outside interface and a random port#
route outside 0.0.0.0 0.0.0.0 [GatewayIP]


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[fraustbyte]

Two other questions:

1.) If I want to allow hosts on the inside to be able to browse the web do I need the following?:

access-list access_list_in permit udp any any eq domain

2.) If I want to use an external time source do I need the following?:

access-list access_list_in permit udp any any eq ntp

Thanks,
newbie

 

[NetworkGhost]

1.) Yes and also add

access-list access_list_in permit udp any any eq domain
access-list access_list_in permit tcp any any eq www
access-list access_list_in permit tcp any any eq https

2) Yes that should work.



Free Firewall/Network/Systems Support-

http://firewalls.ath.cx

 

[fraustbyte]

Ok, so just so I'm clear with reference to "1.)" about DNS traffic did you mean that I need an entry for both "tcp" and "udp" dns traffic?

 

[Supergrrover]

DNS is just UDP.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[NetworkGhost]

Only UDP. The TCP is for Web traffic

Free Firewall/Network/Systems Support-

http://firewalls.ath.cx