Basic PIX 506E Questoin

[stevedeb]

Here is the situation. I have a PIX 506E that is up and running but I need to add an interface/subnet.

The network is currently

Internet Router <-> PIX <-> ISA <-> Current Subnet

I need to add another network on the PIX internal interface. Adding the virtual and its VLAN has been successfull and I can ping it and access that interface with PDM and telnet. However, I cannot get it to pass traffic externally.

This new network will be

Internet Router <-> PIX <-> ISA <-> Current Subnet
^
|
v
New Subnet

The new interface is named 'Private'

I apprecaite any help.


Thanks,
Steve

Here is my config.

Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet1 vlan2 physical
interface ethernet1 vlan3 logical
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan3 private security99
enable password YXL54BfcUFTSGrsk encrypted
passwd YXL54BfcUFTSGrsk encrypted
hostname stansell-pix
domain-name stansellelectric.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 110 permit icmp any any
access-list 110 deny ip host 24.44.18.163 any
access-list 110 deny ip 61.0.0.0 255.0.0.0 any
access-list 110 deny ip host 205.209.144.10 any
access-list 110 deny ip 210.0.0.0 254.0.0.0 any
access-list 110 deny ip 218.0.0.0 255.0.0.0 any
access-list 110 deny ip 220.0.0.0 255.0.0.0 any
access-list 110 permit tcp any host 209.168.199.74 eq www
access-list 110 permit tcp any host 209.168.199.74 eq https
access-list 110 permit tcp any host 209.168.199.74 eq ftp
access-list 110 permit tcp any host 209.168.199.74 eq smtp
access-list 110 permit gre any host 209.168.199.74
access-list 110 permit tcp any host 209.168.199.74 eq pptp
access-list 110 permit tcp any host 209.168.199.74 eq 3389
access-list 110 permit icmp any any echo-reply
access-list 110 permit icmp any any time-exceeded
access-list 110 permit icmp any any unreachable
access-list inside_outbound_nat0_acl permit ip any host 10.5.2.254
pager lines 24
logging on
logging timestamp
logging monitor warnings
logging buffered warnings
logging trap debugging
logging device-id ipaddress inside
mtu outside 1500
mtu inside 1500
ip address outside 209.168.199.74 255.255.255.248
ip address inside 192.168.120.1 255.255.255.248
ip address private 10.5.3.250 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface private
ip audit name outbound-attack attack action alarm drop
ip audit name inbound-attack attack action alarm drop reset
ip audit name outbound-info info action alarm
ip audit name inbound-info info action alarm
ip audit interface outside inbound-info
ip audit interface outside inbound-attack
ip audit interface inside outbound-info
ip audit interface inside outbound-attack
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.120.2 255.255.255.255 inside
pdm location 192.168.120.0 255.255.255.0 inside
pdm location 24.44.18.163 255.255.255.255 outside
pdm location 61.0.0.0 255.0.0.0 outside
pdm location 205.209.144.10 255.255.255.255 outside
pdm location 210.0.0.0 254.0.0.0 outside
pdm location 218.0.0.0 255.0.0.0 outside
pdm location 220.0.0.0 255.0.0.0 outside
pdm location 10.5.2.254 255.255.255.255 outside
pdm location 10.5.2.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 1 209.168.199.74
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (private) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 209.168.199.74 192.168.120.2 netmask 255.255.255.255 0 0
access-group 110 in interface outside
route outside 0.0.0.0 0.0.0.0 209.168.199.73 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:00:01 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.120.0 255.255.255.0 inside
http 10.5.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community stansell
no snmp-server enable traps
tftp-server private 10.5.2.252 /
floodguard enable
sysopt connection tcpmss 0
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt noproxyarp outside
sysopt noproxyarp inside
telnet 192.168.120.0 255.255.255.0 inside
telnet 10.5.2.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.120.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
vpdn enable outside
terminal width 80
Cryptochecksum:1ae467d03cfc24a17f22320711d54bd3
: end
[OK]

 

[Supergrrover]

The config looks right and I have set this up similarly before.
Do you have a VLAN aware switch attached to the internal interface?


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[stevedeb]

Yes, it is a Dell 3448. It is not nearly the best switch that i have ever used but it will do VLANs.

The VLANs seem to work OK because I can ping the 'Private' interface.

The config looks good to me too. I am new to PIX but I have worked with several other Firewalls and the concepts are all the same.

Any ideas?

 

[Supergrrover]

Ok, I think this is the problem -
global (outside) 1 interface
global (outside) 1 209.168.199.74
static (inside,outside) 209.168.199.74 192.168.120.2 netmask 255.255.255.255 0 0

The static is overriding the global. You need to make one of them a different IP or use Policy NAT
static (inside,outside) tcp 209.168.199.74 [Port#] 192.168.120.2 [Port#] netmask 255.255.255.255 0 0
One static statement for each of these - www, https, ftp, smtp, pptp, 3389
(You should also remove the global (outside) 1 interface)



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[stevedeb]

Sorry that I dropped off on this one. I have been in class and I am not able to get to my FW to work on it.

I will try suggested changes. The only thing that I need to mention which I think that I neglected to mention is that everything works OK from the Inside interface. All of the NAT commands seem to be letting traffic pass properly for that interface.

Does that change anything?

 

[Supergrrover]

Nope, shouldn't.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[stevedeb]

I think i understand the why the static NAT is in place. This firewall was originally just fronting an ISA server which was set up before me. I don't like ISA so I am taking steps to move around it.

Without touching the current NAT setup, can I set another global for another ip address. The publics are a /29 so there are some extras that I can use. If so do I just add another global command with the address that I want to use, or do I have to assign the address to an interface first?

Sorry that this thread is dragging on, I really have not been in the office much.

Thanks for any help.

 

[Supergrrover]

Just want to make sure I understand -
Your new subnet will be off the private interface and it will not use the isa server, but you will have boxes off the inside interface that will use the isa?

You will have to change the current static if you want anything to pass to the inside network. These three all conflict.
global (outside) 1 interface
global (outside) 1 209.168.199.74
static (inside,outside) 209.168.199.74 192.168.120.2 netmask 255.255.255.255 0 0

For the new private you are right. Just add a new global/NAT pair.

global (outside) 2 209.168.199.74
nat (private) 2 10.5.3.0 255.255.255.0 0 0

The 2 tells it how to pair them up so no overlaps with the other.


Brent
Systems Engineer / Consultant
CCNP, CCSP