How to Allow certain ports through to all hosts and...

[kirby449]

Hi guys

I want to open 2 ports through our PIX to all internal hosts but I have 3 network cards in the PIX.

One card is on 192.168.1.0, and the other 192.168.5.0.

I only want to open the ports to the 192.168.5.0 network.

Is there a way to do this?

Cheers
KG1

 

[khaiyang]

perhaps you should provide more information so that people here can help to troubleshoot. By default, traffic from more secured interface can access the less secured interface without having specify any rules, all you need is the "nat" and "global" command to perform addression translation (since pix is not a router).

 

[LloydSev]

access-list <whatevername> permit <protocol> any 192.168.5.0 255.255.255.0 eq <port#>

<whatevername> = Access List Name
<protocol> = TCP, UDP, ICMP, (not IP)
<port#> = Port #, example HTTP is 80.

Computer/Network Technician
CCNA

 

[LloydSev]

btw, khaiyang, he was asking how to open up certain ports, so people from the outside interface could access these ports on hosts in the internal or dmz interface.

Computer/Network Technician
CCNA

 

[kirby449]

Thanks for the help guys. LloydSev, spot on - exactly what I needed to know. Many thanks

 

[ChrisAC]

To allow inbound connections to ALL hosts on a network, you would have to have a global IP address and static NAT for each one as the connection to that port would have to be made to a particular global IP address. How else would you direct traffic to those ports? On what external IP address? You can't direct traffic to an RFC1918 address from the internet (well you can but you may not have much success!) Adding an access list to the external interface allowing traffic to 192.168.5.0 /24 is only any good if traffic to that network hits your firewall, which it won't unless this is part of a private WAN.

Maybe if you explain the reason why you want to do this we can suggest something?

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[LloydSev]

I just assumed he had already mapped the addresses successfully and needed to open those specific ports.

Computer/Network Technician
CCNA

 

[kirby449]

Yes, thanks guys - as LloydSev thought, I already have the addresses mapped and everything is working now.

Thanks again

 

[ChrisAC]

Coolio. I was just checking.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************