Allow ports 1720 and 3230-3237 through PIX 501

[robp123]

PIX version 6.2

I need to allow the following ports:
TCP 1720
TCP & UDP 3230-3237

From 130.63.63.11 and 130.63.63.115 to an internal host with an address of 192.168.1.150. External/Public pix interface for the sake of this example is 50.50.50.50. So far I have

access-list video_in permit tcp host 130.63.63.11 host 50.50.50.50 eq 1720
access-list video_in permit tcp host 130.63.63.115 host 50.50.50.50 eq 1720
access-list video_in permit tcp host 130.63.63.11 host 50.50.50.50 range 3230 3237
access-list video_in permit tcp host 130.63.63.115 host 50.50.50.50 range 3230 3237
access-list video_in permit udp host 130.63.63.11 host 50.50.50.50 range 3230 3237
access-list video_in permit udp host 130.63.63.115 host 50.50.50.50 range 3230 3237
access-group video_in in interface outside

From what I've read this should allow the proper port ranges through my pix. Assuming the above configuration is correct, I believe I need a static command to forward external port specific traffic but I can't seem to get the command correct. Can anyone shed some light on this matter for me?

static (inside,outside) 50.50.50.50 192.168.1.150 netmask 255.255.255.255 0 0

I tried inserting the above command but that caused every host on my internal network to not have internet communication. I believe its causing all traffic coming in on 50.50.50.50 to be forwarded to my internal host 192.168.1.150. Is there any way to make the above static command port specific?

As far as my configuration goes (im not 100% on my terminology) but I believe Im running PAT (one public IP address shared by many internal hosts) if that helps at all.

Thanks in advance.

 

[Supergrrover]

You need to forward the whole IP to the inside host for that ACL to work (or do a PAT line for each and every port which is annoying.)
If you add the line and all your traffic stops - do you only have a single external IP?

Map incoming port to an IP and port on the inside (one line for each port)-
static (inside,outside) [TCP/UDP] [ExternalIP/interface] [Port#] [InteralIP] [Port#] netmask 255.255.255.255


Anything in brackets needs to be replaced for your specific config. Bold means you have to enter a value (either a port # or IP address)

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[robp123]

Someone else suggested adding the exact same port specific mapping to my inside host. I came up with the following config but am still having issues:

static (inside,outside) tcp interface 1720 192.168.1.150 1720 netmask 255.255.255.255
static (inside,outside) tcp interface 3230 192.168.1.150 3230 netmask 255.255.255.255
static (inside,outside) tcp interface 3231 192.168.1.150 3231 netmask 255.255.255.255
static (inside,outside) tcp interface 3232 192.168.1.150 3232 netmask 255.255.255.255
static (inside,outside) tcp interface 3233 192.168.1.150 3233 netmask 255.255.255.255
static (inside,outside) tcp interface 3234 192.168.1.150 3234 netmask 255.255.255.255
static (inside,outside) tcp interface 3235 192.168.1.150 3235 netmask 255.255.255.255
static (inside,outside) tcp interface 3236 192.168.1.150 3236 netmask 255.255.255.255
static (inside,outside) tcp interface 3237 192.168.1.150 3237 netmask 255.255.255.255

static (inside,outside) udp interface 3230 192.168.1.150 3230 netmask 255.255.255.255
static (inside,outside) udp interface 3231 192.168.1.150 3231 netmask 255.255.255.255
static (inside,outside) udp interface 3232 192.168.1.150 3232 netmask 255.255.255.255
static (inside,outside) udp interface 3233 192.168.1.150 3233 netmask 255.255.255.255
static (inside,outside) udp interface 3234 192.168.1.150 3234 netmask 255.255.255.255
static (inside,outside) udp interface 3235 192.168.1.150 3235 netmask 255.255.255.255
static (inside,outside) udp interface 3236 192.168.1.150 3236 netmask 255.255.255.255
static (inside,outside) udp interface 3237 192.168.1.150 3237 netmask 255.255.255.255

Any other thoughts on what I may be doing wrong? Thanks for your assistance.

 

[robp123]

And yes, I only have one external/public IP address.

 

[Supergrrover]

If you only have 1IP then you need to do a static PAT for each port. Kind of sucks but there isn't a way for ranges.

Brent
Systems Engineer / Consultant
CCNP, CCSP