Port Redirection Trouble - Config not working 1

[Wy0kid]

I am a PIX Newbie and have been working on getting a new 506E Version 6.3 up and an running. I have a bunch of ports I need to redirect off our only outside IP but I just started with HTTP, HTTPS and FTP to see if I could get it working ... but no luck so far. Here's the config, I have been bangin my head all morning.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password gsAWvnbCBQH8qjoG encrypted
passwd cwsFBDjz5UG67VAy encrypted
hostname bendgate
domain-name uci.net
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list acl_in permit ip any any
access-list acl_in permit icmp any any
access-list acl_out permit tcp any host 216.104.74.98 eq https
access-list acl_out permit tcp any host 216.104.74.98 eq www
access-list acl_out permit tcp any host 216.104.74.98 eq ftp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 216.104.74.98 255.255.255.224
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 216.104.74.98

http://www 192.168.0.9

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp 216.104.74.98 https 192.168.0.9 https netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp 192.168.0.9 ftp netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_in in interface inside
route outside 0.0.0.0 0.0.0.0 216.104.74.97 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authentication http console LOCAL
ntp server 216.104.72.10 source outside prefer
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 192.168.0.24 ./bendgate.cfg
floodguard enable
telnet timeout 5
ssh 192.168.0.0 255.255.255.255 inside
ssh 192.168.0.0 255.255.255.0 inside
ssh timeout 30
console timeout 0
username bendgate password 7Ye8bUiyazX0/aEO encrypted privilege 2
terminal width 80

 

[themut]

Modify your static translations to include the keyword interface instead of the global IP address:

static (inside,outside) tcp interface

http://www 192.168.0.9

http://www netmask

255.255.255.255

 

[Wy0kid]

Thank You, that seems to work for hosts outside the firewall, however I still cannot get to our web server located behind the firewall via its domain name. I am forwarding ports 80 and 443 to its internal address. However if I try to reach the server from the local network going to its public address the PIX must be blocking the traffic from coming back in. I have tried changing the global address to a secondary address with the thought that maybe it regects packets addressed from itself. Any more ideas?

 

[themut]

Where is your DNS server located? Is it off the inside or outside interface? If you have an internal DNS server then you should resolve the domain name to its private IP address for your internal users there´s no other way about it. Now if your DNS server is on the outside then you need to configure the alias command and dns doctoring or you could also just add the keyword "dns" at the end of your static translation. Here´s a link that will help you configuring the alias command:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aee.shtml

 

[Wy0kid]

Thank you. Our internal network resolves initially from a Windows 2000 DNS server for local hosts located on our local net, secondarily from an Internet DNS server (which is where it is resolving our web servers domain address from). Would I be able to work around this issue by giving the Web Server its own external IP and NAT-ing it statically?

Chris
Network Analyst
United Communications, Inc.