PIX 501 and 2 PC Anywhere Hosts

[Xanjiin]

Looking for a way to allow remote access to 2 PC Anywhere hosts through a PIX 501. The PIX is now configured to allow access to 1 of the hosts (see config below). Notice the static ip address (a.b.c.9). Is there a way to assign another public ip (a.b.c.10) to the PIX's outside interface so that incoming requests on this ip address would route to the second PC Anywhere host? Will I need to use PAT since PC Anywhere uses 5631 and 5632 tcp/udp? I'm already talking to one inside host (192.168.0.209). I need to talk to another inside host (192.168.0.210).

PIX 501 Configuration that allows PC Anywhere to access 1 inside host:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxx encrypted
hostname xxx
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list out2in permit tcp any any eq pcanywhere-data
access-list out2in permit udp any any eq pcanywhere-status
no pager
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside a.b.c.9 255.255.255.0
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.254 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface pcanywhere-data 192.168.0.209 pcanywhere-data netmask 255.255.255.255 0 0
static (inside,outside) udp interface pcanywhere-status 192.168.0.209 pcanywhere-status netmask 255.255.255.255 0 0
access-group out2in in interface outside
route outside 0.0.0.0 0.0.0.0 a.b.c.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 192.168.0.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd address 192.168.0.100-192.168.0.120 inside
dhcpd dns 192.168.1.10 x.x.x.x
dhcpd lease 36000
dhcpd ping_timeout 750
dhcpd domain xxxxxxxxx
dhcpd enable inside
terminal width 80

Thanks for the help!
-XAN

 

[craigbulmer]

Have you given any thought to using the vpn client and then establishing a session to whichever host you want?

 

[Xanjiin]

Yes, but I'd like to do it without the additional hardware cost, if possible.

 

[themut]

If you have a PIX firewall there is no hardware cost involved for IPSec VPN. The 3DES license is free of charge nowadays and no hardware components are needed. All you need is a static public IP address on the outside interface on the PIX and the VPN client.

 

[Xanjiin]

Is there a way to do this without using the VPN client?

 

[LloydSev]

You said you have a second public IP correct?

use a static command to assign the second machine a public IP then...

static (inside,outside) a.b.c.10 192.168.0.210 netmask 255.255.255.255 0 0

your current ACL should support then connecting to this machine via the outside IP that you static to it.

Computer/Network Technician
CCNA