Sorry for my poor english but i am

[dexterdata]

Sorry for my poor english but i am from holland

I now there are a lot of thread's about this issue

but i tryed al the answers on my 501 pix but i still can not make a telnet connection to my exchange server.
when i try to connect with telnet true port 25 i only get a black screen and after a while the message that the connection is terminated.
When i remove the pix i can connect to the exchange server.
When i remove the server and only connect the pix to de adsl modem then i have the black screen.

my config is this

PIX Version 6.1(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pixfirewall

fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
names
access-list acl_out permit tcp any host 62.xxx.xxx.48 eq smtp
pager lines 24
logging on
logging console debugging
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 62.xxx.xxx.50 255.255.255.248
ip address inside 172.16.1.1 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
pdm location 172.16.1.5 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 62.xxx.xxx.51
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 62.xxx.xxx.48 172.16.1.5 netmask 255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 62.xxx.xxx.49 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 172.16.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:0402ccd0d80bc7a113b26d92f3dfea08
: end
[OK]

when i look at the packet logging
(debug packet outside dst 62.xxx.xxx.48 proto tcp dport 25 bot)
Then there are packets coming in when i try to telnet but they say nothing that the ip adres is being translated

tryed port mapping did not work.

i am out of options so any new thing to try i will appreciate.

pat

 

[netwrkr]

Your problem is right here:

global (outside) 1 62.xxx.xxx.51
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 62.xxx.xxx.48 172.16.1.5 netmask 255.255.255 0 0


you are translating everything inside to the outside address of 62.x.x.51. When you telnet to 62.x.x.48 the PIX sends the return packets back to the computer that initiated the telnet -from- the IP address .51 which the initiating computer is not expecting.

Visualize this:

Telnet Computer -> 62.x.x.48 -> Server
The server then responds back and the PIX xlates the IP address to your .51 address.

For a quick fix do this:

change the global statement to read:

global (outside) 1 62.xxx.xxx.48 (the same as the IP address you are trying to telnet to)

you may have to type 'clear xlate' &/or 'clear xlate static'
but it should now work.

The other solution which is more involved would be to setup an access list wherease all internal hosts say 1-47 are xlated to the .52 address and your internal telnet server is xlated to .48.

This is a bit confusing, made even more so by the fact the Cisco docs are not correct.

Tom

 

[netwrkr]

you may also need to configure an access-list to allow telnet coming in; though if this was/is a problem you should be seeing denied packets:

login to the console

conf t
logging console debug
logging on

then try to telnet to the IP address.

 

[dexterdata]

it works now but not right away
because all traffic was redirected to 172.16.1.5 the internet traffic from my users where not working any more.
i solved that bij only redirect smtp trafic to that ip address.
But think that the better solution is to work whith the access lists
But how do i make a range of ip addresses
i only can make a subnet work but not a range or just 1 ip address whithin a subnet.

so far thanks it is working it only needs some optimalisation