Help configuring basics of PIX 515E R

[kjohansen]

Hi,

How du i configure a PIX 515 E to let clients on the LAN access the Internet.. Here's my configuration...

PIX Version 6.3(1)
interface ethernet0 auto shutdown
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxx.xxxx encrypted
hostname Pix515E
domain-name something.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xxx.xx.xxx 255.255.255.248
ip address inside 10.100.110.20 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.100.110.1 255.255.255.255 inside
pdm location 10.100.110.145 255.255.255.255 inside
pdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.100.110.1 255.255.255.255 inside
http 10.100.110.145 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.100.110.0 255.255.255.0 inside
telnet timeout 15
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:ccb9110eaa7fa924c2d42554047a55fc
: end
Pix515E#


i'm totally new to PIX firewall's, i've configured lots of watchguard boxes and thats easy, but this seems a little more complex..

So for starters i would like to know just how to just ping through the PIX ( ping the WAN interface )... thanks..

I guess it's all about NAT and Access-List's

Best regards

Kenneth..

 

[marsmann]

to allow ping replies from inside LAN out and back apply the following access-list:

access-list Outside-In permit icmp any any echo-reply

add any other rules needed and then bind it to the interface with:

access-group Outside-In in interface outside.

Assuming there are no other firewalls and anything unusual in your environment you need to enable NAT for users and PAT. To do so, simply do:

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

the above will allow any and all addresses (in case you have wan links and other subnets)

otherwise you could do:

nat (inside) 1 10.100.0.0 255.255.0.0
or
nat (inside) 1 10.0.0.0 255.0.0.0 for all 10.x.x.x networks you may have.

then, you add:

global (outside) 1 interface

or if you have multiple public IP's and want to use ranges you can use an address or a range in your global statement. You can use the IP of the pix outside interface or others if you have them available. The above allows you to translate out via the PIX's outside address. The one below uses a specific (or other address or ranges)

global (outside) 1 22.22.22.22 netmask 255.255.255.0
global (outside) 1 22.22.22.22-22.22.22.100 netmask 255.255.255.0

your config has the outside interface shutdown by the way...