PIX 501 nat issue

[jacksun0426]

I have a Cisco Pix 501 running and I cannot get a NAT to work. Here's what I need to do:
One of our systems runs a webcam stream, which we want to make available on a website. The service we are using to stream this needs to be able to contact our server that has the cam attached to it so it can pull the stream.
They need to contact our server on port 5700, and I assume it is TCP. Their test uses

http://xxx.xxx.xxx.xxx:5700

to check where xxx.xxx.xxx.xxx is my external facing IP.

Here is what I have tried, but it doesn't work. The 192.168.0.100 IP is the server with the cam on it.


access-list camstream_inbound permit tcp any interface outside eq 5700
static (inside,outside) tcp interface 5700 192.168.0.100 5700 netmask 255.255.255.255 0 0
access-group camstream_inbound in interface outside

My external interface is called outside, and my internal is called inside

Any help would be appreciated.

Regards,
Wayne

 

[unclerico]

Does the webcam actually run on TCP/5700 or does the external service just use TCP/5700 to connect?? Perhaps the webcam actually runs on say, TCP/80; if this is the case change your static to this:

static (inside,outside) tcp interface 5700 192.168.0.100 80 netmask 255.255.255.255

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[jacksun0426]

Actually the camera stream encoder that runs on our server listens on port 5700 for the incoming request from the external service. It isn't actually the webcam, but the encoder application that the external service is trying to connect to.
That request, from everything I have read is on port 5700.

Wayne

 

[unclerico]

can you tell me:
1) if you see any deny messages in your logs
2) if you run wireshark on the server can you see the requests reaching the server

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[jacksun0426]

Hi, I don't run wireshark on any machines, I have turned on capture on the firewall but I am not seeing anything at all..I just ran

capture outside to start it, then show capture outside to see anything, is there a more robust log I can turn on or look at?

 

[unclerico]

do you have logging enabled??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[jacksun0426]

I have enabled syslog logging, - logging on command, not sure how I view it though

Wayne