Strange problem

[destinyml]

Hi

I have a problem with my pix 515e. I have one line in my accesslist:

access-list outside-in line 5 permit ip any any

So all trafic through the firewall should be allowed. I do not run NAT and most IP addresses are working fine. However some addresses are not allowed through. It seams random what IP's are not allowed access and all IPs are pingable from the pix.

It seams that interfaces with multible IP addresses are having problems. I have one interface on a server with 3 IP addresses but only 2 of them are allowed through (all can be pinged from the pix). Also linux systems are not working that well.

I guess it must be some setting on the pix or maybe one missing? My conf is included below.

Thank you

interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XX encrypted
passwd XX encrypted
hostname XX
domain-name XX
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service

http://WWW tcp

port-object eq https
port-object eq www
object-group service FTP tcp
port-object eq ftp
port-object eq ftp-data
object-group service MAIL tcp
port-object eq pop3
port-object eq smtp
object-group service DNS tcp-udp
port-object eq domain
access-list outside-in permit ip any any
no pager
mtu outside 1500
mtu inside 1500
ip address outside XX
ip address inside XX
ip audit name Inside_Info info action alarm
ip audit name Inside_Attack attack action alarm drop reset
ip audit name Outside_info info action alarm
ip audit name Outside_Attack attack action alarm drop reset
ip audit interface outside Outside_info
ip audit interface outside Outside_Attack
ip audit info action alarm
ip audit attack action alarm
ip audit signature 2000 disable
ip audit signature 2001 disable
ip audit signature 2003 disable
ip audit signature 2004 disable
ip audit signature 2005 disable
pdm history enable
arp timeout 14400
nat (inside) 0 0.0.0.0 0.0.0.0 0 0
access-group outside-in in interface outside
route outside XX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http XX outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh XX outside
ssh timeout 30
console timeout 0
terminal width 80

 

[themut]

I think the problem is you are using NAT 0 and you expect the same behaviour provided by a static translation. What is hapening is as follows:

An inside host access the outside thus generating an xlate entry (even though you have NAT 0 configured), then an outside host tries successfully to acces the internal machine.

An outside host tries unsuccessfully to access an internal machine (IP Address) which has not previously establish a session to the outside. This resource cannot be accessed from the outside unless it starts a connection to the outside first.

You need to modify your translations in order to work as espected. Say your internal network is 10.1.1.0, you need to get rid of your nat (inside) 0 .... statement and configured the following static translation instead:

static (inside, outside) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

with this translation in place all internal hosts can be accessed from the outside regardless of who starts the connection.

 

[destinyml]

Thank you... that did it... althougn I had to add

static (outside,insde) 10.1.1.0 10.1.1.0 netmask 255.255.255.0