pix firewall outside interfaces

[Laylobrown]

Customer had 1 pix firewall connected to 1 t-1. Now they have 2 t-1's and will be getting a range of ip addresses. Now we have been using it because it's easy to configure but now a bit of brain work for non cisco experts come into play.

Question.

what steps do i need to take to

1. configure the pix so that instead of 1 outside ip address it will allow access to a tange of 16, so that if need be i can assign an ip address for the web server, application server, etc...

2. is there a script i can copy and paste into the command line because i'm tired of the PDM.

 

[Supergrrover]

As long as the IPs are contiguous you are good to go. You will just need to add a static for each IP or service that you want to host internally and then allow it in the ACL.

PIX IP - 192.168.253.10 /24
services

http://WWW -

internal:10.10.10.10 / 24 external:192.168.253.12
SMTP - internal:10.10.10.20 / 24 external:192.168.253.13

These do PAT or port mapping
static (inside,outside) tcp 192.168.253.12

http://www 10.10.10.10

http://www netmask

255.255.255.255
static (inside,outside) tcp 192.168.253.13

http://www 10.10.10.20

http://www netmask

255.255.255.255

These do the whole IP
static (inside,outside) 192.168.253.12 10.10.10.10 netmask 255.255.255.255
static (inside,outside) 192.168.253.13 10.10.10.20 netmask 255.255.255.255

Here is a rough template, just replace the services

http://www.cisco.com/en/US/products...s_configuration_example09186a00807d287e.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[Laylobrown]

how do i allow remote desktop to access inside?

 

[Supergrrover]

Just follow directions in that link.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[skb2005]

You can try the following for RDP (Remote Desktop Protocol)

access-list acl_in_RDP permit tcp any host MY.PUBLIC.IP eq 3389
static (inside,outside) tcp MY.PUBLIC.IP 3389 MY.LOCAL.IP 3389 netmask 255.255.255.255 0 0
access-group acl_in_rdp in interface outside

Hope this helps...

 

[Laylobrown]

Thanks guys, With your assistance everything worked out perfectly. the rdp does work as well as their gps tracking application.