non-contiguous public IP's...and global/static/nat prob 1

[yert33]

One PIX 520 behind 1 router. Had 6 useable public IP addresses xxx.194.91.248/29 and then I needed 2 more (I'm static-ing all original 6, need 2 more static's for a couple of PCAnyhwere host machines). ISP assigned me additional public IP's of xxx.194.91.104/29.

So I thought I should:
1) global (outside) 2 xxx.194.91.110 netmask 255.255.255.248
then
2) static (inside,outside) xxx.194.91.105 192.168.1.12 netmask 255.255.255.255 0 0
along with
3) access-list acl_out permit tcp any host xxx.194.91.105 eq pcanywhere-data
access-list acl_out permit udp any host xxx.194.91.105 eq pcanywhere-status

but I can't access the the machine from the outside. I have a feeling that I need to add a NAT statement and maybe put the private address of the host machine toward the upper end the scope of 192.168.1.0 255.255.255.0....or something.

Anyway, here's the config. Can someone tell me what I'm missing?

Thanks much in advance.



PIX Version 6.3(3)
interface ethernet0 10baset
interface ethernet1 100full
interface ethernet2 100full
interface ethernet3 100full
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security40
nameif ethernet3 dmz2 security20
nameif ethernet4 dmz3 security60
nameif ethernet5 dmz4 security80
enable password xxxxxxxx encrypted
passwd xxxxxxxx encrypted
hostname xxx
domain-name xxxx
fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list compiled
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host xxx.194.91.252 eq pcanywhere-data
access-list acl_out permit udp any host xxx.194.91.252 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.194.91.252 eq www
access-list acl_out permit udp any host xxx.194.91.252 eq www
access-list acl_out permit tcp any host xxx.194.91.252 eq lotusnotes
access-list acl_out permit udp any host xxx.194.91.252 eq 1352
access-list acl_out permit tcp any host xxx.194.91.252 eq smtp
access-list acl_out permit tcp any host xxx.194.91.253 eq pcanywhere-data
access-list acl_out permit udp any host xxx.194.91.253 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.194.91.253 eq www
access-list acl_out permit udp any host xxx.194.91.253 eq www
access-list acl_out permit tcp any host xxx.194.91.253 eq lotusnotes
access-list acl_out permit udp any host xxx.194.91.253 eq 1352
access-list acl_out permit tcp any host xxx.194.91.253 eq smtp
access-list acl_out permit tcp any host xxx.194.91.251 eq www
access-list acl_out permit udp any host xxx.194.91.251 eq www
access-list acl_out permit tcp any host xxx.194.91.251 eq pcanywhere-data
access-list acl_out permit udp any host xxx.194.91.251 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.194.91.251 eq ftp
access-list acl_out permit tcp any host xxx.194.91.251 eq ftp-data
access-list acl_out permit udp any host xxx.194.91.251 eq 20
access-list acl_out permit udp any host xxx.194.91.251 eq 21
access-list acl_out permit udp any host xxx.194.91.105 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.194.91.106 eq pcanywhere-data
access-list acl_out permit udp any host xxx.194.91.106 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.194.91.105 eq pcanywhere-data
access-list acl_inside permit udp any any
access-list acl_inside permit tcp any any
access-list acl_inside permit icmp any any
access-list acl_dmz2 permit icmp any any
access-list acl_dmz2 permit tcp any any
access-list acl_dmz2 permit udp any any
access-list acl_dmz1 permit tcp any any
access-list acl_dmz1 permit udp any any
access-list acl_dmz1 permit icmp any any
pager lines 24
logging on
logging timestamp
logging trap errors
logging facility 6
logging host inside 192.168.1.5
no logging message 106011
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
mtu dmz2 1500
mtu dmz3 1500
mtu dmz4 1500
ip address outside xxx.194.91.250 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip address dmz1 192.168.2.4 255.255.255.0
ip address dmz2 192.168.3.4 255.255.255.0
no ip address dmz3
no ip address dmz4
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz1
no failover ip address dmz2
no failover ip address dmz3
no failover ip address dmz4
pdm history enable
arp timeout 14400
global (outside) 1 xxx.194.91.254 netmask 255.255.255.248
global (outside) 2 xxx.194.91.110 netmask 255.255.255.248
global (dmz1) 1 192.168.2.94 netmask 255.255.255.0
global (dmz2) 1 192.168.3.94 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz1) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz2) 1 0.0.0.0 0.0.0.0 0 0
alias (inside) xxx.194.91.251 192.168.2.10 255.255.255.255
alias (inside) 192.168.1.5 xxx.194.91.253 255.255.255.255
alias (inside) 192.168.1.2 xxx.194.91.252 255.255.255.255
static (inside,outside) xxx.194.91.252 192.168.1.2 netmask 255.255.255.255 0 0
static (inside,outside) xxx.194.91.253 192.168.1.5 netmask 255.255.255.255 0 0
static (dmz1,outside) xxx.194.91.251 192.168.2.10 netmask 255.255.255.255 0 0
static (inside,dmz1) 192.168.2.15 192.168.1.2 netmask 255.255.255.255 0 0
static (inside,outside) xxx.194.91.105 192.168.1.12 netmask 255.255.255.255 0 0
static (inside,outside) xxx.194.91.106 192.168.1.13 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_inside in interface inside
access-group acl_dmz1 in interface dmz1
access-group acl_dmz2 in interface dmz2
route outside 0.0.0.0 0.0.0.0 xxx.194.91.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.60-192.168.1.125 inside
dhcpd dns 168.215.165.186 216.136.33.82
dhcpd lease 82800
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Cryptochecksum:c116cd8cc425a8fb12cf70e0998e8c7c

 

[dx1]

On the router, add a route for the new subnet and point it to the outside ip of the PIX.

 

[yert33]

Thank you dx1....but sorry to be so uninformed: can you suggest the router statement I need to add? Here is the router config....

Thank you.

Using 873 out of 29688 bytes
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname xxxxx
!
boot system flash c2600-is-mz.120-7.T.bin
enable password xxxxx
!
!
!
!
!
memory-size iomem 10
ip subnet-zero
!
!
!
!
!
!
interface FastEthernet0/0
description xxxx LAN
ip address xxx.194.91.249 255.255.255.248
no ip directed-broadcast
speed 10
half-duplex
!
interface Serial0/0
ip address yyy.54.253.54 255.255.255.252
no ip directed-broadcast
encapsulation ppp
no ip route-cache
no ip mroute-cache
no fair-queue
pulse-time 3
!
ip classless
ip route 0.0.0.0 0.0.0.0 yyy.54.253.53
no ip http server
!
!
line con 0
password xxxx
login
transport preferred none
transport input none
line aux 0
password xxxx
login
line vty 0 4
password xxxx
login
transport preferred none
!
no scheduler allocate
end

 

[dx1]

ip route xxx.194.91.104 255.255.255.248 xxx.194.91.250

 

[yert33]

Thank you! Worked great.

But just so I learn something here and don't remain just an attentive monkey, what is the ip route statement doing? Routing all inbound traffic destined for the xx.194.91.104/29 subnet to the outside interface of the PIX where it is goes on into the LAN, I assume. But what I don't see in my router config is a sister statement directing the xx.194.91.248/29 traffic to the PIX...what am I missing?

Thanks, again, dx1...

 

[dx1]

You are correct. Your ISP routes the new subnet to you. Once it hits your router, it needs to know where to go.
You don't see the other route statement because the PIX IP and your router interface are on the same subnet.

 

[yert33]

Excellent explanation, dx1 and much appreciated.