Inbound connections on a 515e without NAT
- From: "B Squared"
- Date: Wed, 19 Apr 2006 22:06:45 -0700
All,
I have a PIX 5i5E configured that permits outbound connections
from inside our network. However I can't get it to permit inbound
ones. I know this should be fairly simple, I think the complication
is we aren't doing NAT, and are using the same addresses inside as
outside. Here's the revelant part of our configuration.
PIX Version 7.0(4)2
! we use NAT control but use our real addresses on the inside
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
interface Ethernet0
nameif outside
security-level 0
ip address A.B.50.14 255.255.255.0
interface Ethernet1
nameif inside
security-level 100
ip address A.B.70.1 255.255.255.0
route outside 0.0.0.0 0.0.0.0 A.B.50.1 1
! So far this part works as it should, here's
! the part I'm having trouble with. Lets say I
! I have a web server at A.B.70.50, From what I've
! read, I would have thought the following would
! permit inbound traffic to it.
access-list permit_web extended permit tcp any host A.B.70.50 eq 80
access-group permit_web in interface outside
static (inside,outside) A.B.70.50 A.B.70.50 netmask 255.255.255.255
But, this fails. My thinking was to allow a connection for the address
of the web server. So when this failed, I thought, maybe I allow
the connection on the outside interface, like:
static (inside,outside) A.B.50.14 A.B.50.14 netmask 255.255.255.255
Even though, if this worked, it would allow inbound connections to every system behind A.B.50.14 on the PIX. But even this doesn't work.
I've looked pretty carefully through _Cisco PIX Firewalls_ (Behrens, et al) and through other postings in this group, but they all use NAT / PAT. In fact, it seems as though the static(,) command pretty much expects some form of address translation, and isn't very happy unless it occurs.
Thanks in advance for any help.
B Squared
=========================================================================
I've gone to hundreds of fortune-tellers' parlors, and have been told
thousands of things, but nobody ever told me I was a policewoman
getting ready to arrest her. --Unknown NYC Detective
.
- Follow-Ups:
- Re: Inbound connections on a 515e without NAT
- From: rdymek@xxxxxxxxx
- Re: Inbound connections on a 515e without NAT
- From: Walter Roberson
- Re: Inbound connections on a 515e without NAT
- From: help@xxxxxxxxxxxxxxxxxx
- Re: Inbound connections on a 515e without NAT
- Prev by Date: Re: Setting up VPN from Windows XP to a Cisco router
- Next by Date: Autonomous or LWAPP for fast roaming
- Previous by thread: Cisco Call Manager 4.13 - Blocking inbound calls?
- Next by thread: Re: Inbound connections on a 515e without NAT
- Index(es):
Relevant Pages
|
