PIX 515 port redirection/forwarding problem

[asaxty]

Hi all

Note ip-address's have been changed

I have been trying to set up port forwarding from 1 external interface (195.217.251.180) to internal interface (150.1.15.1) for inbound notes web mail access which uses HTTPS. I have searched the entire internet and tried many different config's none of which have been sucsessful as yet, im at the point where im convinced it doesn't work but it looks like many other people have it working so I must be wrong!

Note PIX terminates VPN sessions as primary function

Senario

A user enters

https://195.217.251.180:4004

which should hit the PIX outside interface, I then expect the PIX to forward connection to inside server address 150.29.2.2 on port 4004

I have attached my config below (ip-address's changed)

Any help would be greatly appreaciated

:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname FIRSTPIX01
domain-name firstbus.com
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol http 80
no fixup protocol ftp 21
names
access-list inside_outbound_nat0_acl permit ip any 150.1.15.0 255.255.255.192
access-list outside_cryptomap_dyn_20 permit ip any 150.1.15.0 255.255.255.192
access-list VPNUSERA permit ip any host 10.250.38.24
access-list VPNUSERA permit ip any host 10.250.65.9
access-list VPNUSERA permit ip any host 10.250.65.11
access-list VPNUSERA deny ip any any
access-list VPNUSERB permit tcp any host 10.250.64.20 eq pcanywhere-data
access-list VPNUSERB permit udp any host 10.250.64.20 eq pcanywhere-status
access-list VPNUSERC permit ip any host 10.250.65.254
access-list VPNUSERD permit ip any host 150.141.2.50
access-list VPNUSERD permit ip any host 150.141.2.10
access-list VPNUSERD permit ip any host 150.141.2.60
access-list VPNUSERD permit ip any host 150.141.2.80
Static (inside, outside) tcp interface 4004 150.29.2.2 4004
pager lines 24
logging on
logging console notifications
logging trap debugging
logging host inside 150.1.15.100
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 195.217.251.180 255.255.255.240
ip address inside 150.1.15.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNCLIENTS 150.1.15.10-150.1.15.50
pdm location 150.1.15.100 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 10 interface
global (outside) 1 195.217.251.178
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-list webmail permit tcp any host 150.29.2.2 eq 4004
access-group webmail in interface outside
route inside 0.0.0.0 0.0.0.0 150.1.1.3 0
route outside 0.0.0.0 0.0.0.0 195.217.251.190 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server FIRSTGROUP protocol radius
aaa-server FIRSTGROUP (inside) host 150.1.15.100 XXXXXXXX timeout 10
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authorization command LOCAL
http server enable
http 150.1.15.1 255.255.255.255 inside
http 150.1.15.100 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication FIRST
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPNUSERA address-pool VPNCLIENTS
vpngroup VPNUSERA idle-time 1800
vpngroup VPNUSERA password ********
vpngroup VPNUSERB address-pool VPNCLIENTS
vpngroup VPNUSERB idle-time 1800
vpngroup VPNUSERB password ********
vpngroup VPNUSERC address-pool VPNCLIENTS
vpngroup VPNUSERC idle-time 1800
vpngroup VPNUSERC password ********
vpngroup VPNUSERD address-pool VPNCLIENTS
vpngroup VPNUSERD idle-time 1800
vpngroup VPNUSERD password ********
telnet timeout 5
ssh 150.0.0.0 255.0.0.0 inside
ssh timeout 5
username XXXXXXX password xxxxxxxxxxxxxxxxx encrypted privilege 15
username ZZZZZZZ password xxxxxxxxxxxxxxxx encrypted privilege 15
terminal width 80
Cryptochecksum:536f76f35e6e408382b781f3ff45bf75
: end
[OK]

 

[dopehead]

The access-list where you allow https/notes webmail should be to the official address not the internal address.

access-list webmail permit tcp any host 195.217.251.180 eq 4004

Jan

 

[asaxty]

Hi Jan

Thanks for the reply, unfortunatly it will not forward the connection to the desired host..

Im sure what you have said is correct, when I look at the syslog out put I don't see any inbound connection at all registerd, in fact the only blocked traffic I see from syslog is VPN user traffic.

I have used the following entry for HTTPS access in my config.

Static (inside, outside) tcp interface 4004 150.29.2.2 4004
access-list webmail permit tcp any host 195.217.251.180 eq 4004
access-group webmail in interface outside

Still no results

Any other suggestion would be welcomed

Best Regards

 

[dx1]

This is how I have my static to port forward for ftp and it works fine.
static (inside,outside) tcp interface ftp 192.168.1.181 ftp netmask 255.255.255.255 0 0

 

[asaxty]

Thanks for your reply!

Do I have an issue with outside nat should I need it configured ?

When I configure outside nat my VPN service is affected and stops accepting connections, which would be expected due to translation of address's etc.

Best Rgds

 

[dopehead]

Remember also that you should do a "clear xlate" when changing statics and nat configuration in general.

What do you mean when you say outside nat ?
Jan

 

[asaxty]

I only have 2 NAT (inide) statements, do I need an outside Nat statement ?

nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

I have added one several times as a test but each time I nat the outside interface my VPN traffic gets denied by the PIX, So im not sure that will be an option.

Is there anyway of debugging incoming connections, i.e. how can I verify that the inbound TCP session actually hit the outside interface ? I have logging to terminal and syslog configured but I don't see any notice to say that it has seen an inbound session from an internet based ip-address.

I have also turned on xlate debugging and when I try to establish the connection

Https://195.217.251.180:4004

I don't see any xlate processes occuring. I beleive I should see something ! Your thoughts

Note when I apply an outside NAT statement the Xlate debugging starts to display messages!

Thanks and best Regards

 

[suresh187]

hi folks i too am having a very similar problem, i too have the Pix mainly for VPN , and am trying to port forward to my mail server...

i have submitted a post also...