Could someone please help? 1

[mfinley]

I can't figure out why RDP won't work with this configuration,

PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password euobsWYWY37GElk2 encrypted
passwd euobsWYWY37GElk2 encrypted
hostname XXXXXX
domain-name XXXXXX.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list outside permit icmp any any
access-list outside permit tcp any host x.x.x.x eq smtp
access-list outside permit tcp any host x.x.x.x eq 3389
access-list acl_out permit tcp any host x.x.x.x eq 3389
pager lines 24
logging monitor debugging
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.x 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 10.1.1.1-10.1.1.254
pdm location x.x.x.x 255.255.255.252 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp x.x.x.x 3389 192.168.1.51 3389 netmask

255.255.255.255 0 0
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323

0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup linvpn address-pool ippool
vpngroup linvpn dns-server 192.168.1.50
vpngroup linvpn wins-server 192.168.1.50
vpngroup linvpn idle-time 1800
vpngroup linvpn password ********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
dhcpd address 192.168.1.52-192.168.1.83 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:a01de5551826809d5f655cdc6a33dce8

Any help would be appreciated.
Thank You
mick

 

[MattWray]

Try changing your

access-list acl_out permit tcp any host x.x.x.x eq 3389

to

access-list acl_out permit tcp any interface outside eq 3389


Matt Wray

http://www.sss-steel.com

 

[mfinley]

Thank you MattWray, but this pix won't accept that command.
the software ver. is 6.1(1) I think this is a problem as I've tried other commands from working environments but with higher ver. 6.3(4).

 

[MattWray]

You'll need to change outside to the name of your outside interface - either ethernet0 or ethernet1 from your config

Matt Wray

http://www.sss-steel.com

 

[MattWray]

so for yours I think it would be

access-list acl_out permit tcp any interface ethernet0 eq 3389

Matt Wray

http://www.sss-steel.com

 

[mfinley]

XXXXXX(config)# access-list acl_out permit tcp any interface ethernet0 eq 3389
Type help or '?' for a list of available commands.
XXXXXX(config)#

Matt, This is what I get when trying that command.
Thank you for your help and quick response.

mick

 

[MattWray]

Is it possible to upgrade your IOS?

Matt Wray

http://www.sss-steel.com

 

[boymarty24]

You need to apply your access-list to the outside interface.

access-group outside in interface outside

 

[MattWray]

good catch!

Matt Wray

http://www.sss-steel.com

 

[mfinley]

Thanks for your help guys! I tried your suggestions but it still fails, I don't have access to Cisco to update the O/S.
Question: should I reset the to factory default and go from there?

Thanks again
mike

 

[MattWray]

Is this a test system or production environment? Have you verified that RDP works inside the firewall?

Matt Wray

http://www.sss-steel.com

 

[mfinley]

Matt,
Yes it works inside, Yes it is in production.

mike