PIX 501 and Alias

[stakano]

I have a PIX 501 with a server on the inside that is accessible from the outside with the routable IPonly, using the static command;

static (inside,outside) <outside IP> 192.168.0.101 netmask 255.255.255.255 0 0

There are inside users that also need to access this internal server using the same routable IP. I have played with the alias commands to no avail.

I have tried
- alias (inside) <outside IP> 192.168.0.101 and also reversing them and no luck

Can anybody help?

 

[criticalUpdate]

maybe a silly question but where is the dns server that the client is pointing to? Is it an ISP's or hosted internally ? Jeff

 

[stakano]

The DNS is external.

The only difference is that to access this server from the outside, it is IP only and not by hostname.

The idea is that it is using DNAT (Destination NAT), but it doesn't seem to work.

 

[mtashiro]

Should work as follows:


alias (inside) <inside IP> <Outside IP> 255.255.255.255

Also make sure proxy-arp is disabled

sysopt noproxyarp <internal interface>

What version of PIX OS are you running?

 

[yizhar]

HI.

Do not use ALIAS - it can cause more problems and will not solve the problem.

Why do the users need to use the external ip address? Try to avoid this in the first place.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[mtashiro]

Users aren't trying to use the extrenal address. They need to use the internal address and they do not have an internal DNS server.

I have used the alias command in several of my installs without issues. Do you have specifics on why you don't like the command?

 

[yizhar]

The alias command is problematic especially in a 2 interfaces pix environment.
If one does not disable proxy-arp, it can block the traffic to the server private ip address.
It will not help much in the situation above because if the traffic is destined to the registered ip of the server, then no matter what - if it goes to the pix (default gateway), the pix won't pass it back to the server on same interface.

If you have a scenario with 3 interfaces or more, then alias may be more usefull, but this is not the case here.
If you need to use DNS FQDN names, then alias may also help if configured properly, but as described by the &quot;Stakano&quot; this is not the case here.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[stakano]

I am running 6.3.1 now.. I was using 6.2.2 for a while.

mtashiro, can you explain how you got this to work? Was it on a 501 box?

I still can't seem to get it to work...