PIX 501 port forwarding

[nathanedin]

Hey All,

Been bashing my head over this for an hour now and it's not making sense... All i'm trying to achieve is a simple forward of port 5900 to 192.168.2.200 but the error log shows this:

305005: No translation group found for tcp src outside:192.168.1.150/44718 dst inside:192.168.2.200/5900

(.150 is a pc on the same subnet as this pix's outside interface)

I understand what this means but can't figure out what is wrong with this config. See below:

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inbound permit tcp any host 192.168.2.200 eq 5900
pager lines 24
logging on
logging standby
logging console errors
logging monitor errors
logging buffered errors
logging trap warnings
logging history errors
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.1 255.255.255.0
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp interface 5900 192.168.2.200 5900 netmask 255.255.255.255 0 0
access-group inbound in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.254 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 10
console timeout 0
dhcpd address 192.168.2.200-192.168.2.220 inside
dhcpd dns 8.8.8.8
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Cryptochecksum:f05cafe5070b4750219d3e92f4d05af0
: end

If someone can see what I'm doing wrong here it would be much appreciated.

Cheers,

N

 

[Supergrrover]

Your access list needs to be for the outside interface or it's ip not the internal one it's mapped to.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[nathanedin]

Not sure I understand, this is what the 'inbound' ACL is mapped to:

access-group inbound in interface outside

Could you expand on what you mean?

Thanks

 

[nathanedin]

Think I understand what you meant but that doesn't work..

I added:

access-list inbound permit tcp any host 192.168.1.1 eq 5900

and still get the error:

305005: No translation group found for tcp src outside:192.168.1.150/46622 dst inside:192.168.2.200/5900

The hit count for the original rule increments but that new rule is at 0 so guess it doesn't match.

Must be something else I've done wrong?

 

[Viconsul]

Hi,

Try this

access-list inbound permit tcp host 192.168.2.200 interface outside eq 5900
static (inside,outside) tcp interface 5900 192.168.2.200 5900 netmask 255.255.255.255 0 0

HTH

-Viconsul

 

[nathanedin]

Thanks guys, your pointers all clicked at what I needed to do:

access-list inbound line 1 permit tcp any interface outside eq 5900 (hitcnt=1)

Keep up the good work