Allow server acces from outside using Static and Access list 1

[wcadmin]

Hi,

I am trying to allow outside access to a server that is on the inside protected net. I am adding the static and access-list commands to a working config. Each time I add the static command the pix stops working in either direction. No traffics comes in or goes out. The goal is to add access to an inside web server for users comming in via the outside(intrenet). I have attahce the commands I am adding below and a copy of the working config prior to adding the additional static command. Any help is much appreciated.

Thanks in advance.


Additional commands:

static(inside,outside) 'outside ip addr' 192.169.1.90

access-list web-acl permit tcp any host 'outside ip addr' eq www

access-group web-acl in interface outside

'outside ip addr' is assigned to the outside interface via my pppoe connection. Yes, I adjust the command everytime I get a new address.


Working config prior to adding the above commands:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd encrypted
hostname pixfirewall
domain-name mdlmail.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list acl_out permit ip any any
access-list inside_access_in permit ip any any
access-list inside_outbound_nat0_acl permit ip any 192.169.2.0 255.255.255.224
pager lines 24
logging on
logging console debugging
logging history debugging
interface ethernet0 auto
interface ethernet1 auto
icmp permit any echo-reply inside
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.169.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpniprange 192.169.2.10-192.169.2.20
pdm location 12.146.0.0 255.255.255.0 outside
pdm logging debugging 512
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
rip outside default version 1
rip inside default version 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client configuration address initiate
crypto map outside_map client configuration address respond
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup mdladmin address-pool vpniprange
vpngroup mdladmin dns-server 151.203.0.84 151.203.0.85
vpngroup mdladmin idle-time 1800
vpngroup mdladmin password ****
telnet timeout 5
ssh x.x.x.x 255.255.255.0 outside
ssh timeout 15
vpdn group pppoe-verizon request dialout pppoe
vpdn group pppoe-verizon localname vze3s3nr
vpdn group pppoe-verizon ppp authentication pap
vpdn username vze3s3nr password ****
dhcpd address 192.169.1.10-192.169.1.50 inside
dhcpd dns 151.203.0.84 151.203.0.85
dhcpd lease 2073600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Cryptochecksum:93669a96806dbc00992c4ffb37313ead

 

[baddos]

If you are going to use the static, you will need a different IP than that of the outside interface.

 

[wcadmin]

Hi,

Is their another option besides using static to allow outside connections to an inside server?

Also, can you explain a little as to why a second IP address is needed when static is used? I am assuming you are saying I would need another internet registered IP address.

Thanks.

 

[baddos]

Try this...

static(inside,outside) interface

http://www 192.169.1.90

http://www netmask

255.255.255.255 0 0

access-list 101 permit tcp any any eq 80
access-group 101 in interface outside

This will allow port 80 into the 192.169.1.90 computer using the PIX's outside IP address.

-Bad Dos

 

[wcadmin]

Hi,

I added the commands you suggested above, replacing 192.169.1.90 with the ip address of my inside server. Although the pix is no longer shutting down all traffic it still is not letting outside traffic into the web server. I have noted a couple of things that may be of interest.

Prior to adding the static and access-list commands I am able to ping the outside interface on the pix from an internet source external to my network. After adding the commands to the pix I am no longer able to ping the outside interface or at least I do not receive a reply from the ping. I have noticed the following message on the console when trying the ping:denied ICMP type=8, code=0 from Internet-addr on interface.

I tried allowing icmp-echo on the access-list and still received the same results.

If you have any other suggestions it would be a great help.

Thanks,

w.

 

[rubbaninja]

Before I blab, I think your answer lies in port redirection. See config guide located at cisco's website.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_62/config/mngacl.pdf

"Using the static command for port redirection.

Now to blab just in case.
You shouldn't use your outside ip in a static, more so if your using stateful failover, which I don't see in your cfg. Best practice not to.

Do you have any public ip address's? If so, you would want to use one of them for your static.

Also, you have 3 different access-lists and only two access-groups.

You should consider simplifying your access-lists and groups.

Try something nice and simple:
access-group acl-outside in interface outside
access-group acl-inside in interface inside


Your cfg in general looks a bit odd to me... maybe a redo is needed.

--------

If you use the access-list and groups naming I suggested you would want to look like this:

static (inside,outside) "public ip" "private(internal) ip" netmask 255.255.255.255 0 0

access-list acl-outside permit tcp any host "public ip" from static" eq www

To make things a little more clear, below is the same as above with numbers plugged in, I'll use yahoo's IP and pretend i am the pix admin.

static (inside,outside) 66.218.71.198 192.169.1.90 netmask 255.255.255.255 0 0

access-list acl-outside permit tcp any host 66.218.71.198 eq www

access-list acl-inside permit tcp host 192.169.1.90 any eq www
(You have a allow any inside statement so you really wouldn't need the acl-inside permit acl; access-list inside_access_in permit ip any any)

So thats my blab, The link will probably be your best bet!

 

[wcadmin]

Thanks for the reply. As far as I can see, port redirection is the solution that baddos had suggested also. I have made these configuration changes and still I am not getting through to my server. I have gotten to the point where I can ping the interface with the static command defined and the access list applied however.

We only have one public ip available to us at this point so we do not have the option of using an additional ip right now. If I have read all the documentation correctly this should not be necessary however. Based on my understanding of the docs the following form of the static command should allow you to use port redirection by sharing your existing outgoing interface:

static(inside,outside) tcp interface

http://www <inside

server addr> 80 netmask x.x.x.x

If I am misunderstanding how that works please let me know.

Any additional comments or suggestions would be appreciated.

Thanks,

w

 

[baddos]

Yes... That should work. Try modifying your ACL to allow ANY ANY eq 80. This might be causing the problem. Then do a clear xlate and test.

-Bad Dos

 

[wcadmin]

I tried the 'any any eq 80' and still no luck. This looks like a strange one. Based on the docs and your feedback I think I understand how this works now but I am still not getting the expected results. Can you think of anything else I should try?

Also, anyides why I do not get any debug traffic when I attempt the http connect? I would expect to see a deny or some sort.

Thanks,

W

 

[baddos]

Add this to your config, and then do a &quot;show logging&quot;

logging buffered debugging

Try to access the server via telnet &quot;outside PIX ip&quot; 80. If it connects, type &quot;GET /&quot;

 

[wcadmin]

When I try to connect to the server using telnet 'outside ip' 80 I get &quot;could not open a connection to the host on port: connection failed. Still no debug activity showing up.

Interesting enough however, if I try to telnet to port 23 it does not of course connect but I do see the attemp on the console.

I am flat out of ideas to try.

 

[baddos]

Verify connectivity to the 192.169.1.90 host from the PIX. Also make sure that the 192.169.1.90 host's default gateway is configured properly.

 

[wcadmin]

Hi,

From my internal net I can get to the 192.169.1.90 server with no problem. It is a web server and I can access all the web services on the machine internally. I can access it locally and from any other box on the same internal net and I can also ping the server from the PIX console. The gateway for the server is pointing to the PIX.

Thanks,

w

 

[baddos]

Please verify that the server can view websites, etc from the internet. It looks to me from what you are saying is that nothing is getting to the server from the PIX, so I want to see if the server can get to the internet through the PIX.

-Bad Dos

 

[wcadmin]

From the server I can access the internet, i.e. I can open a web page on a server on the internet. I can also ping external boxes from the server.

 

[baddos]

OK. Please post your current config.

 

[wcadmin]

Here is the lates copy of my config. Note that the &quot;any any&quot; settings on the outside interface are temporary for debugging. I know that I need to changes these for production.

Thanks much for your help so far.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd encrypted
hostname pixfirewall
domain-name mdlmail.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list inside_access_in (2) permit tcp any any
access-list inside_access_in (2) permit ip any any
access-list inside_access_in (2) permit udp any any
access-list inside_outbound_nat0_acl (3) permit ip any 192.169.2.0 255.255.255.224
access-list web-acl (4) permit tcp any any eq www
access-list web-acl (4) permit tcp any any eq telnet
pager lines 24
logging on
logging console debugging
logging monitor debugging
logging buffered debugging
logging history debugging
interface ethernet0 auto
interface ethernet1 auto
icmp permit any echo-reply inside
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.169.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpniprange 192.169.2.10-192.169.2.20
pdm logging debugging 512
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface

http://www 192.169.1.11

http://www netmask

255.255.255.255 0 0
access-group web-acl in interface outside
access-group inside_access_in in interface inside
rip outside default version 1
rip inside default version 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client configuration address initiate
crypto map outside_map client configuration address respond
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup mdladmin address-pool vpniprange
vpngroup mdladmin dns-server 151.203.0.84 151.203.0.85
vpngroup mdladmin idle-time 1800
vpngroup mdladmin password ****
telnet timeout 5
ssh 12.146.0.0 255.255.255.0 outside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 15
vpdn group pppoe-verizon request dialout pppoe
vpdn group pppoe-verizon localname vze3s3nr
vpdn group pppoe-verizon ppp authentication pap
vpdn username vze3s3nr password ****
dhcpd address 192.169.1.10-192.169.1.20 inside
dhcpd dns 151.203.0.84 151.203.0.85
dhcpd lease 2073600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Cryptochecksum:
: end

 

[baddos]

Remove this &quot;access-group inside_access_in in interface inside&quot; and see what it does.

The config looks fine otherwise. I think the inside_access_in might be blocking it since it's the outside pix IP address that the

http://www traffic

is leaving w/.

-Bad Dos

 

[wcadmin]

I finally figured this out. Unfortunately it really had nothing to do with the PIX. Our network administrators in their infinite wisdom have apparently blocked initiating incoming connections on port 80. Given that my server was of course listening on port 80 this was the source of the problem. I have changed the port for the server and all is working well.

This explains why I was not seeing any reject traffic on the PIX. The request was never reaching the PIX.

Thanks again Bad Dos for all of your help on this. Your ideas are what guided me to finding the solution for this problem.

Thanks again,

w