How do I get web/mail/SSL past the PIX

[Dyehouse1]

Here is my config (largely unedited) and I am having some problems. Firstly I need to add some aliases to the external interface so that it can forward different DNS names etc. How do I go about this? Secondly the mail runs on the current external IP BUT with this config I am not getting anything - cannot connect via POP or IMAP. Where am I going wrong? - HELP!

PIX Version 6.1(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password XXXX encrypted
passwd XXXX encrypted
hostname XXXX
domain-name XXXX
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000

access-list outside_access_in permit tcp any eq smtp host 212.240.x.18 eq smtp
access-list outside_access_in permit tcp any eq pop3 host 212.240.x.18 eq pop3
access-list outside_access_in permit tcp any eq 443 host 212.240.x.18 eq 443
access-list outside_access_in permit tcp any eq 143 host 212.240.x.18 eq 143
access-list outside_access_in permit tcp any eq 1723 host 212.240.x.18 eq 1723
access-list outside_access_in permit tcp any eq

http://www host

212.240.x.20 eq www
access-list outside_access_in permit tcp any eq ftp host 212.240.x.19 eq ftp
access-list outside_access_in permit tcp any eq 98 host 212.240.x.22 eq 98
access-list outside_access_in permit tcp any eq

http://www host

212.240.x.22 eq www
pager lines 24
logging monitor notifications
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 212.240.x.18 255.255.255.224
ip address inside 10.99.99.13 255.0.0.0
ip address dmz 192.168.1.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location Bills_PC 255.255.255.255 inside
pdm location 10.250.250.251 255.255.255.255 inside
pdm location 0.0.0.0 255.255.255.255 inside
pdm location 10.99.99.7 255.255.255.255 inside
pdm location 10.99.99.3 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 212.240.x.18 smtp 10.99.99.7 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp 212.240.x.18 pop3 10.99.99.7 pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp 212.240.x.18 1723 10.99.99.3 1723 netmask 255.255.255.255 0 0
static (inside,outside) tcp 212.240.x.18 143 10.99.99.7 143 netmask 255.255.255.255 0 0
static (inside,outside) tcp 212.240.x.18 443 10.99.99.7 443 netmask 255.255.255.255 0 0
static (dmz,outside) tcp 212.240.x.19 ftp ftp.pas.com ftp netmask 255.255.255.255 0 0
static (dmz,outside) tcp 212.240.x.20

http://www support.pas.com

http://www netmask

255.255.255.255 0 0
static (dmz,outside) tcp 212.240.x.22 98 editor.pas.com 98 netmask 255.255.255.255 0 0
static (dmz,outside) tcp 212.240.x.22

http://www www.pas.com

http://www netmask

255.255.255.255 0 0
access-group outside_access_in in interface outside
rip inside default version 1
route outside 0.0.0.0 0.0.0.0 212.240.x.17 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:15:00 absolute uauth 0:05:00 inactivity
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http Internal_Network 255.0.0.0 inside
http Bills_PC 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside Bills_PC /PIX
floodguard enable
no sysopt route dnat
telnet Bills_PC 255.255.255.255 inside
telnet 10.250.250.251 255.255.255.255 inside
telnet timeout 10
ssh timeout 5
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:67cdaf2aca507ca1d4e69281006f25db
: end

 

[Dyehouse1]

I think you must be right - I am going to be doing a test tonight (cuz everyone will have gone home!) but instead of changing the gateway I will change the firewall internal address so that it is the same as the current firewall (cureent firewall will be disconnected) then simply reset the router and try again with the gateway set to the new PIX. Hopefully this should do the job. I must confess I never even thought of looking at the gateway - good answer - gold star for you!

 

[Dyehouse1]

Excellent - it was the gateway addresses all alone! DOH! Thanks for the help I am nearly done. 2 small issues remain:

1) I need to allow my DMZ webserver (192.168.1.2) access to the inside mail server (10.99.99.7) and sql server (10.99.99.12) - How do I go about this? On the old server they used 'IP Pass Through Filter Rules' no such thing exists under PIX.

2) Final issue is DNS. Internal clients can't use FQDN to access the DMZ FTP server and webserver it just times out. They can get there using the correct DMZ address (192.168.1.2 for example) am I right in saying this is just a case of adding some DNS entries on the Internal DNS servers that points ftp.pas.com to 192.168.1.2.

Thanks for all the help I feel like I am nearly home now!

 

[yizhar]

HI.

1) I need to allow my DMZ webserver ...
It is similar to allowing access from outside to DMZ.
Use static (inside,dmz) ... + access-list ...
Try to be restrictive as possible.
Always keep in mind that an attacker might compromise your DMZ web server - what level of access are you willing to let an attacker to have in such case.

2) Final issue is DNS. Internal clients can't use FQDN ...
Yes, the best solution is to modify internal DNS zone.
Remember to reboot the workstation afterwards to clear the DNS cache.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[routerman]

Excellent, pleased that you got there eventually!

 

[Dyehouse1]

Many thanks to all those who have helped me through these trying times. PIX firewalls are by any means the easiest beasts to conquer but once you get the hang of it they certainly aren't the worse either.

Special thanks to routerman who has answered all my sarcastic questions and even found out the wrong gateway issue - genius! I'd buy you a beer if I lived near you

Thanks lastly to Yizhar for his oracle-like wisdom at the end.

Bill