Would like a range of 20 PC's access to the internet via the PIX

[geranimo666]

Hello-

So what is the best way of doing this...

I have appointed 20 pc's static IP's on a 10.1.23.x range and they need to get out to the web for various reasons. would this be an extended access-list? a static route? not sure what the right method is here. The perimeter router let's traffic outside from what I can tell and do feel I'd need to make these entries at the router (I could be wrong here) but what could I do at the pix515 to try it at least?

thanks for any info
geranimo

 

[Supergrrover]

One line for each IP.
access-list outbound permit host 10.1.23.x any

access-list outbound in interface inside

Or if you want to restrict it to certain ports - one for each port and IP combination
access-list outbound permit host 10.1.23.x any eq 80 (or whatever port # you need)


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[geranimo666]

Hey thanks Brent

For the second option concerning ports, would I need to also apply it to the interface "inside"?

thanks again

geranimo

 

[Supergrrover]

Yes. It would be the same. It restricts traffic inbound to that interface.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[geranimo666]

All-

I type the commands above but I receive an error :
pix2(config)# access-list 101 permit host 10.1.23.125 any eq 80
ERROR: invalid protocol host
Usage: [no] access-list compiled
[no] access-list deny-flow-max <n>
[no] access-list alert-interval <secs>
[no] access-list <id> object-group-search
[no] access-list <id> compiled
[no] access-list <id> [line <line-num>] remark <text>
[no] access-list <id> [line <line-num>] deny|permit
<protocol>|object-group <protocol_obj_grp_id>
<sip> <smask> | interface <if_name> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>]
<dip> <dmask> | interface <if_name> | object-group <network_obj_grp_id>
[<operator> <port> [<port>] | object-group <service_obj_grp_id>]
[log [disable|default] | [<level>] [interval <secs>]]
[no] access-list <id> [line <line-num>] deny|permit icmp
<sip> <smask> | interface <if_name> | object-group <network_obj_grp_id>
<dip> <dmask> | interface <if_name> | object-group <network_obj_grp_id>
[<icmp_type> | object-group <icmp_type_obj_grp_id>]
[log [disable|default] | [<level>] [interval <secs>]]
Restricted ACLs for route-map use:


I used both types --> just permit host any and the more specific any eq 80.. received same error. thinking there is a syntax issue..

thanks for any support
geranimo

 

[brianinms]

It should be

access-list 101 permit tcp host 10.1.23.125 any eq 80

 

[geranimo666]

Briainms

yes that did it! many thanks!

geranimo