PIX 501, DHCP, PCANYWARE 1

[Kaboum]

Hi,
In my office i have a PIX 501 where it's WAN port is connected on my Alcatel Speed Touch modem and receives through my ISP DHCP server an IP of range 10.110.x.x,my public IP which is dynamic as well is 213.x.x.x

Now I want to open the PCanyware ports 5631,5632 on the PIX in order i will be able to access from home, my office computer located behind the PIX on he private IP 192.168.10.10

My PIX 501 Version is 6.1(2).

I found some things about Access-list, Access-group commands but to be honest i'm confused..... I’ will really appreciate if someone can enlighten me with some examples on how this commands can be used correctly in my case.


Thanks in advance

Kaboum

 

[yizhar]

HI.

First - you should remeber that if you don't sepcify IP address for the remote computer (your home PC), it means that once PCAW access is open, anyone on the Internet can access it, and some will also try to.
So - you must first decide if you want this option, and if so, you should have strong authentication, auditing (logging) and control using your PCAW options built in the software itself.

For the pix configuration, you can try something like this.
First, get the pix current configuration.
If you currently have an access-list bound to the outside interface, add statements to it. If not, then you create a new access-list.

This is how you can create a new one:
access-list fromoutside permit tcp any any eq 5631
access-list fromoutside permit udp any any eq 5632
access-group fromoutside in interface outside

And you will need to port forward from the pix single ip address to the internal PCAW host. It can be done like this:
static (inside,outside) tcp interface 5631 192.168.10.10 5631
static (inside,outside) udp interface 5631 192.168.10.10 5632

http://www.cisco.com/warp/public/707/28.html#topic9

Since you do not have a static ip, create on your office workstation a shortcut/link to:

http://www.whatismyip.com

http://www.showmyip.com

And check it before you leave the office.

A better option is to get a range of fix registered ip addresses from your ISP instead of using a single dynamic ip address. For this, the pix configuration is different.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Kaboum]

Hi, yizhar

Thanks mate, your answer was spot on, i already implement it and PIX working just fine.....

Again, Thanks.

Regards

Kaboum