PIX 501 port 80 forwarding problem

[mitch2008]

Hi Folks,

I have a port 80 forwarding problem and need you guys help. I configured VPN and PCAnywhere and made them work. But now I need to open

http://www port.

The following is the running configuration. Anything wrong?

Building configuration...
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password T2YNf9vL8BQ0xM16 encrypted
passwd T2YNf9vL8BQ0xM16 encrypted
hostname PIX-PORT2
domain-name ***.local2
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 permit ip 192.168.3.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list FIELD_splitTunnelAcl permit ip 192.168.3.0 255.255.255.0 any
access-list outside_cryptomap_dyn_20 permit ip any 192.168.4.0 255.255.255.0
access-list pcany permit tcp any any eq pcanywhere-data
access-list pcany permit udp any any eq pcanywhere-status
access-list itany permit tcp any any eq pcanywhere-data
access-list itany permit udp any any eq pcanywhere-status
access-list itany permit tcp any any eq 5633
access-list itany permit udp any any eq 5634
access-list axiscam permit tcp any interface outside eq www
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.168.3.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool FIELD-IPS 192.168.4.1-192.168.4.254
pdm location 192.168.3.0 255.255.255.0 inside
pdm location 192.168.1.0 255.255.255.0 inside
pdm location 192.168.1.0 255.255.255.0 outside
pdm location 192.168.2.0 255.255.255.0 inside
pdm location 192.168.4.0 255.255.255.0 inside
pdm location 192.168.1.5 255.255.255.255 inside
pdm location 192.168.3.5 255.255.255.255 outside
pdm location 192.168.3.5 255.255.255.255 inside
pdm location 192.168.3.100 255.255.255.255 inside
pdm location 192.168.3.20 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 100
nat (inside) 1 192.168.3.0 255.255.255.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface pcanywhere-data 192.168.3.100 pcanywhere-data netmask 255.255.255.255 0 0
static (inside,outside) udp interface pcanywhere-status 192.168.3.100 pcanywhere-status netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5633 192.168.3.5 5633 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 5634 192.168.3.5 5634 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface

http://www 192.168.3.20

http://www netmask

255.255.255.255 0 0
access-group axiscam in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.3.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
http 192.168.4.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset3 esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map PORTvpn 10 ipsec-isakmp
crypto map PORTvpn 10 match address 101
crypto map PORTvpn 10 set peer 111.222.333.444
crypto map PORTvpn 10 set transform-set myset3
crypto map PORTvpn 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map PORTvpn client authentication LOCAL
crypto map PORTvpn interface outside
isakmp enable outside
isakmp key ******** address 111.222.333.444 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp keepalive 40 3
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash sha
isakmp policy 1 group 1
isakmp policy 1 lifetime 86400
isakmp policy 21 authentication pre-share
isakmp policy 21 encryption 3des
isakmp policy 21 hash md5
isakmp policy 21 group 2
isakmp policy 21 lifetime 86400
vpngroup FIELD address-pool FIELD-IPS
vpngroup FIELD dns-server 192.168.3.5
vpngroup FIELD wins-server 192.168.3.5
vpngroup FIELD default-domain port.local2
vpngroup FIELD split-tunnel FIELD_splitTunnelAcl
vpngroup FIELD idle-time 1800
vpngroup FIELD password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 192.168.3.0 255.255.255.0 inside
telnet 192.168.1.0 255.255.255.0 inside
telnet 192.168.2.0 255.255.255.0 inside
telnet 192.168.4.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPPoE request dialout pppoe
vpdn group PPPoE localname ***@bellsouth.net
vpdn group PPPoE ppp authentication chap
vpdn group dialup accept dialin pptp
vpdn group dialup ppp authentication mschap
vpdn group dialup client configuration address local FIELD-IPS
vpdn group dialup client configuration dns 192.168.3.5 205.152.144.23
vpdn group dialup client configuration wins 192.168.3.5
vpdn group dialup pptp echo 300
vpdn group dialup client authentication local
vpdn username username@bellsouth.net password *********
dhcpd address 192.168.3.2-192.168.3.3 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside

terminal width 80
Cryptochecksum:f540a2f42691336c72c59ced7f17d3d8
: end
[OK]

 

[Supergrrover]

You can only apply one acl to an interface. You need to combine your

http://www with

your pcanywhere statements - take a look at this..

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080862017.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mitch2008]

Thanks for your reply, Supergrrover. I am using SSH and changed but it is still not working. I tested using yougetsignal.com and it said the port 80 is closed. Relative lines are listed bellow. Any ideas?



.....
access-list 101 permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 permit ip 192.168.3.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list FIELD_splitTunnelAcl permit ip 192.168.3.0 255.255.255.0 any
access-list outside_cryptomap_dyn_20 permit ip any 192.168.4.0 255.255.255.0
access-list pcany permit tcp any any eq pcanywhere-data
access-list pcany permit udp any any eq pcanywhere-status
access-list pcany permit tcp any any eq www
access-list itany permit tcp any any eq 5633
access-list itany permit udp any any eq 5634

.......
global (outside) 1 interface
nat (inside) 0 access-list 100
nat (inside) 1 192.168.3.0 255.255.255.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface pcanywhere-data 192.168.3.100 pcanywhere-data netmask 255.255.255.255 0 0
static (inside,outside) udp interface pcanywhere-status 192.168.3.100 pcanywhere-status netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5633 192.168.3.5 5633 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 5634 192.168.3.5 5634 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface

http://www 192.168.3.20

http://www netmask

255.255.255.255 0 0
access-group pcany in interface outside

 

[Supergrrover]

It looks to be good a fwe things to check -
1. Check to make sure this is your

http://WWW server's

IP
2. The server has the proper gateway ip
3. There isn't any local firewall blocking it

Now for your ACL - this works but you should tighten it up a bit for later

access-list pcany permit tcp any any eq pcanywhere-data
access-list pcany permit udp any any eq pcanywhere-status
access-list pcany permit tcp any any eq www

should be

access-list pcany permit tcp any interface outside eq pcanywhere-data
access-list pcany permit udp any interface outside eq pcanywhere-status
access-list pcany permit tcp any interface outside eq www



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mitch2008]

Hi Supergrrover. The

http://WWW server

works fine inside and we do not have any other firewalls. Even without the

http://www server,

the firewall should pass the port forwarding test, right? I used website tools and telnet to test it. Cisco devices drive me crazy sometimes. Still need help. Thanks again.

 

[Supergrrover]

The firewall should give it an undetermined/filtered for the test if nothing is live on the inside server.

I meant the server's software firewall. They can be locked down so that only certain subnets are allowed to talk to it. Can you get on the internet with the server? (google.com, cisco.com, etc. - ie the gateway and dns are working on the server.)

Try the modified ACLs as well. There have been problems with the interface using PAT and not using the interface keyword in the ACL.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mitch2008]

Thanks a lot, Supergrrover. You are right! The problem comes from the webserver. I set up another one and the port forwarding works fine now.