General NAT question

[neutec]

Hello Everyone,
Im have issues with nat and a server which is behind my PIX firewall. I only have one static ip address which is being used by the PIX. I've created a access-list of:

access-list acl_inside permit ip 192.168.0.0 255.255.255.0
access-list acl_outside permit tcp any host 10.0.0.20 eq smtp
access-list acl_outside permit tcp any host 10.0.0.20 eq www
access-list acl_outside permit tcp any host 10.0.0.20 eq 443
access-list acl_outside deny icmp any any

access-group acl_outside in interface outside
access-group acl_inside in interface inside


I then add a Static route of:
static (inside,outside) 66.215.146.1xx 192.168.0.20 netmask 255.255.255.255 0 0

66.215.146.1xx is my outside static ip. After adding this I can not longer access the internet from any other workstation other them 192.168.0.20.
I need to allow access to the entire 192.168.0.xxx network. any one know what I need to add to this config to make this work?

Thanks

 

[rudeboy]

You must use PAT(port address translation). Remove your static mapping and use the list below. Also on your access-list, specify the public address instead of 10.0.0.20.



static (inside,outside) tcp 66.215.146.1xx 25 192.168.0.20 25 netmask 255.255.255.255
static (inside,outside) tcp 66.215.146.1xx 80 192.168.0.20 80 netmask 255.255.255.255
static (inside,outside) tcp 66.215.146.1xx 443 192.168.0.20 443 netmask 255.255.255.255

 

[neutec]

Thanks for the help. That was the problem, everything seems to be fine now. I have one more question, Where should I place my PIX firewall. Before the router or after the router? I always thought that the firewall should be the first device from the internet then the router but I have heard of doind it the other way around.

Thanks

 

[rudeboy]

Hmmm, what is your internet connection..T1,DSL,cable,etc? Remember that the PIX handles an ethernet handoff, so if you have a T1, you will generally have a router in front of the PIX. If your provider is giving you an ethernet handoff such as cable, then a PIX will work without a router. As far as your LAN to LAN traffic, a router is a must. (sorry for the longwinded speech)

 

[neutec]

Rudeboy,
Would you know what I need to add to deny all echo ICMP request. I basically want to have a stealth firewall that will not responsed to pings. I cant remember of find the command I used last time to disable it.

Thanks

 

[kvashisht]

remove the static command.
use nat and global commands.

nat 1 192.168.0.0
global 1 66.215.146.1xx

Regds,
Kaushal Vashisht
I Am from INDIA. LAND teach the world about Mathamatics & started Universities to educate the world.