Port forwarding on PIX501

Question

Bonjour,  How to set up port forwarding on PIX501 (Cisco)? Thank you

ianvs · Answer

Hello,  Can you explain a little more about what you are trying to do and specify the version level of your PIX?

msmadja · Answer

Hello,

My PIX is version 6.35. My configuration is the factory setting (no additional commands). I have a fixed external IP (with Free)
I would like to
- have a PC that serves as an FTP server (the FTP server is GuildFTP installed on Win98, works well internally)
- know in general how to open a specific port or how to forward a port to a specific PC: for example, I use UltraVNC which requires port 5900 to be redirected to the IP of the server PC or some applications require a particular port to be open
- finally, know if there is a document summarizing the main programming principles of the PIX without having to go through the 600 incomprehensible and unmanageable pages of the PIX reference document
Thank you for your help,
Marc

ianvs · Answer

Hello,

There is no documentation but ready-made examples (which are hard to find).

I never took the time to document it either (my clients have all managed without it).

If you are on 6.3(5), here’s how to add a static translation (to allow access to a server from the outside):
translation for FTP (you need to specify the ports as you only have one public IP)
static (inside,outside) tcp PUBLIC_ADDRESS ftp REAL_ADDRESS ftp [netmask 255.255.255.255] [dns]
- the public address is the address you give to the machine on the outside (probably that of the PIX) or one from the network between the modem and the PIX
- the real address is the IP address of the machine on the internal network
- the first option (netmask ...) is unnecessary because the PIX will handle it by itself
- the second option (dns) allows the PIX to correct DNS responses (unnecessary in your case)
You can use the principle of this command for any other protocol (if the protocol name is unknown - as for VNC - you can use the port number)

Then you will need to open an access-list to allow communication:
access-list ACL_NAME permit tcp any host PUBLIC_ADDRESS eq ftp
- NAME is the name of the access-list, this name will be used to assign the access-list to an interface
- any => we do not know the IP address that will connect in advance
- host PUBLIC_ADDRESS => the "public" address of the server defined in the translation, or you could use another format: PUBLIC_ADDRESS MASK, but this format is clearer for a single IP
- eq ftp = the DESTINATION port must equal 21 (ftp) - there are other options like gt (greater than)

Finally, you need to apply the access-list to the interface in question:
access-group ACL_NAME in interface outside

P.S.: I assumed that the names of the interfaces were inside and outside (the usual standard), but if this is not the case you need to adjust the commands accordingly.

There you go ...

msmadja · Answer

Hello,

Thank you first of all for all this information. I had found something similar on the Cisco website, but I still can't access the FTP server (by entering ftp://PUBLIC_ADDRESS) while I can access it internally...
How can I check what is blocking? (I haven't tried for VNC, but I will try anyway)

ianvs · Answer

To check if the PIX is blocking, you can enter the command "show log". Have you also done translation on the modem?  At worst, send me a private message and we will see your PIX configuration.

msmadja · Answer

Translation on the modem ???? sorry don't know! (it's a standard Freebox modem, without router function activation)

For my config.... below...
Thank you again!

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list ACLOUT permit tcp any host 88.166.222.78 eq ftp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.1.9 255.255.255.255 inside
pdm location 192.168.1.19 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 88.166.222.78 ftp 192.168.1.19 ftp netmask 255.255.255.255 0 0
access-group ACLOUT in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:17ebe0bab980b4c633c90e238132bc49
: end
[OK]

ianvs · Answer

If the BOX is not in router mode, then it's all good.

However, there is an "inconsistency" in the configuration.
If the "outside" interface is in DHCP, you cannot use the same address for translation, but you need to "tell" the PIX to use its own address.

Therefore, I suggest entering the following commands in your PIX:
clear xlate ! to free up the translations
no static (inside,outside) tcp 88.166.222.78 ftp 192.168.1.19 ftp netmask 255.255.255.255 0 0 ! to delete the existing translation
static (inside,outside) tcp interface ftp 192.168.1.19 ftp ! to create the new translation

msmadja · Answer

Hello,  Sorry still not .... I'm starting to despair...

ianvs · Answer

Je suis désolé, mais je ne peux pas exécuter ces commandes.

msmadja · Answer

Hello,

logg histo 50 has returned a syntax error
show static gives:
static (inside, outside) tcp interface ftp 192.168.1.19 ftp netmask 255.255.255.255 0 0

sh xlate gives:
23 in use, 250 most used
PAT Global 88.166.222.78(1034) Local 192.168.1.11(1040)
PAT Global 88.166.222.78(1055) Local 192.168.1.11(1110)
PAT Global 88.166.222.78(11831) Local 192.168.1.11(1028)
PAT Global 88.166.222.78(11829) Local 192.168.1.8(1026)
PAT Global 88.166.222.78(1744) Local 192.168.1.11(1738)
PAT Global 88.166.222.78(1756) Local 192.168.1.10(1048)
PAT Global 88.166.222.78(547) Local 192.168.1.16(752)
PAT Global 88.166.222.78(546) Local 192.168.1.16(753)
PAT Global 88.166.222.78(545) Local 192.168.1.16(754)
PAT Global 88.166.222.78(544) Local 192.168.1.16(755)
PAT Global 88.166.222.78(551) Local 192.168.1.16(747)
PAT Global 88.166.222.78(550) Local 192.168.1.16(748)
PAT Global 88.166.222.78(549) Local 192.168.1.16(750)
PAT Global 88.166.222.78(548) Local 192.168.1.16(751)
PAT Global 88.166.222.78(10755) Local 192.168.1.3(5061)
PAT Global 88.166.222.78(10754) Local 192.168.1.3(5060)
PAT Global 88.166.222.78(10756) Local 192.168.1.4(5060)
PAT Global 88.166.222.78(543) Local 192.168.1.16(756)
PAT Global 88.166.222.78(542) Local 192.168.1.16(757)
PAT Global 88.166.222.78(2851) Local 192.168.1.11(2038)
PAT Global 88.166.222.78(2852) Local 192.168.1.9(1629)
PAT Global 88.166.222.78(2816) Local 192.168.1.9(1591)
PAT Global 88.166.222.78(2846) Local 192.168.1.11(2034)

sh arp gives:
outside 88.166.222.254 0007.cb48.ffdf
inside 192.168.1.11 0019.d142.ac12
inside 192.168.1.3 0018.f802.55fa
inside 192.168.1.14 0050.ba05.d36c
inside 192.168.1.8 000e.0ca1.fb07
inside 192.168.1.9 0013.72ce.78db
inside 192.168.1.16 0013.72ce.859a
inside 192.168.1.18 0013.72ce.efd4
inside 192.168.1.7 0014.222c.89e2
inside 192.168.1.10 0019.2129.b26c
inside 192.168.1.4 0001.e38f.5900
inside 192.168.1.6 0080.778e.1cb1
inside 192.168.1.5 0800.3732.bae5
inside 192.168.1.19 0013.8f81.cd42
inside 192.168.1.13 0040.f46c.f347

sh log gives:
Syslog logging: disabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level notifications, 0 messages logged
Trap logging: disabled
History logging: disabled
Device ID: disabled

Thank you!

msmadja · Answer

Hello,

In my previous message, I hadn't tried to connect to the FTP...

Result of firewall command: "sh xlate"

98 in use, 271 most used
PAT Global 88.166.222.78(13347) Local 192.168.1.9(3284)
PAT Global 88.166.222.78(13346) Local 192.168.1.9(3283)
PAT Global 88.166.222.78(13345) Local 192.168.1.9(3282)
PAT Global 88.166.222.78(13344) Local 192.168.1.9(3281)
PAT Global 88.166.222.78(13351) Local 192.168.1.9(3288)
PAT Global 88.166.222.78(13350) Local 192.168.1.9(3287)
PAT Global 88.166.222.78(13349) Local 192.168.1.9(3286)
PAT Global 88.166.222.78(13348) Local 192.168.1.9(3285)
PAT Global 88.166.222.78(13355) Local 192.168.1.9(3292)
PAT Global 88.166.222.78(13354) Local 192.168.1.9(3291)
PAT Global 88.166.222.78(13353) Local 192.168.1.9(3290)
PAT Global 88.166.222.78(13352) Local 192.168.1.9(3289)
PAT Global 88.166.222.78(13359) Local 192.168.1.9(3296)
PAT Global 88.166.222.78(13358) Local 192.168.1.9(3295)
PAT Global 88.166.222.78(13357) Local 192.168.1.9(3294)
PAT Global 88.166.222.78(13356) Local 192.168.1.9(3293)
PAT Global 88.166.222.78(13363) Local 192.168.1.9(3300)
PAT Global 88.166.222.78(13362) Local 192.168.1.9(3299)
PAT Global 88.166.222.78(13361) Local 192.168.1.9(3298)
PAT Global 88.166.222.78(13360) Local 192.168.1.9(3297)
PAT Global 88.166.222.78(13367) Local 192.168.1.9(3304)
PAT Global 88.166.222.78(13366) Local 192.168.1.9(3303)
PAT Global 88.166.222.78(13365) Local 192.168.1.9(3302)
PAT Global 88.166.222.78(13364) Local 192.168.1.9(3301)
PAT Global 88.166.222.78(13371) Local 192.168.1.9(3308)
PAT Global 88.166.222.78(13370) Local 192.168.1.9(3307)
PAT Global 88.166.222.78(13369) Local 192.168.1.9(3306)
PAT Global 88.166.222.78(13368) Local 192.168.1.9(3305)
PAT Global 88.166.222.78(13375) Local 192.168.1.9(3312)
PAT Global 88.166.222.78(13374) Local 192.168.1.9(3311)
PAT Global 88.166.222.78(13373) Local 192.168.1.9(3310)
PAT Global 88.166.222.78(13372) Local 192.168.1.9(3309)
PAT Global 88.166.222.78(1034) Local 192.168.1.11(1040)
PAT Global 88.166.222.78(13343) Local 192.168.1.9(3280)
PAT Global 88.166.222.78(13342) Local 192.168.1.9(3279)
PAT Global 88.166.222.78(1055) Local 192.168.1.11(1110)
PAT Global 88.166.222.78(13341) Local 192.168.1.9(3278)
PAT Global 88.166.222.78(13411) Local 192.168.1.9(3348)
PAT Global 88.166.222.78(13410) Local 192.168.1.9(3347)
PAT Global 88.166.222.78(13409) Local 192.168.1.9(3346)
PAT Global 88.166.222.78(13408) Local 192.168.1.9(3345)
PAT Global 88.166.222.78(13413) Local 192.168.1.11(4320)
PAT Global 88.166.222.78(13412) Local 192.168.1.11(4318)
PAT Global 88.166.222.78(13379) Local 192.168.1.9(3316)
PAT Global 88.166.222.78(13378) Local 192.168.1.9(3315)
PAT Global 88.166.222.78(13377) Local 192.168.1.9(3314)
PAT Global 88.166.222.78(13376) Local 192.168.1.9(3313)
PAT Global 88.166.222.78(13383) Local 192.168.1.9(3320)
PAT Global 88.166.222.78(13382) Local 192.168.1.9(3319)
PAT Global 88.166.222.78(13381) Local 192.168.1.9(3318)
PAT Global 88.166.222.78(13380) Local 192.168.1.9(3317)
PAT Global 88.166.222.78(13387) Local 192.168.1.9(3324)
PAT Global 88.166.222.78(13386) Local 192.168.1.9(3323)
PAT Global 88.166.222.78(13385) Local 192.168.1.9(3322)
PAT Global 88.166.222.78(13384) Local 192.168.1.9(3321)
PAT Global 88.166.222.78(13391) Local 192.168.1.9(3328)
PAT Global 88.166.222.78(13390) Local 192.168.1.9(3327)
PAT Global 88.166.222.78(13389) Local 192.168.1.9(3326)
PAT Global 88.166.222.78(13388) Local 192.168.1.9(3325)
PAT Global 88.166.222.78(13395) Local 192.168.1.9(3332)
PAT Global 88.166.222.78(13394) Local 192.168.1.9(3331)
PAT Global 88.166.222.78(13393) Local 192.168.1.9(3330)
PAT Global 88.166.222.78(13392) Local 192.168.1.9(3329)
PAT Global 88.166.222.78(13399) Local 192.168.1.9(3336)
PAT Global 88.166.222.78(13398) Local 192.168.1.9(3335)
PAT Global 88.166.222.78(13397) Local 192.168.1.9(3334)
PAT Global 88.166.222.78(13396) Local 192.168.1.9(3333)
PAT Global 88.166.222.78(13403) Local 192.168.1.9(3340)
PAT Global 88.166.222.78(13402) Local 192.168.1.9(3339)
PAT Global 88.166.222.78(13401) Local 192.168.1.9(3338)
PAT Global 88.166.222.78(13400) Local 192.168.1.9(3337)
PAT Global 88.166.222.78(13407) Local 192.168.1.9(3344)
PAT Global 88.166.222.78(13406) Local 192.168.1.9(3343)
PAT Global 88.166.222.78(13405) Local 192.168.1.9(3342)
PAT Global 88.166.222.78(13404) Local 192.168.1.9(3341)
PAT Global 88.166.222.78(1756) Local 192.168.1.10(1048)
PAT Global 88.166.222.78(12452) Local 192.168.1.9(1145)
PAT Global 88.166.222.78(10755) Local 192.168.1.3(5061)
PAT Global 88.166.222.78(10754) Local 192.168.1.3(5060)
PAT Global 88.166.222.78(10756) Local 192.168.1.4(5060)
PAT Global 88.166.222.78(13169) Local 192.168.1.9(3152)
PAT Global 88.166.222.78(13239) Local 192.168.1.11(4296)
PAT Global 88.166.222.78(13240) Local 192.168.1.11(4297)
PAT Global 88.166.222.78(13247) Local 192.168.1.11(4304)
PAT Global 88.166.222.78(13245) Local 192.168.1.11(4302)
PAT Global 88.166.222.78(13244) Local 192.168.1.11(4301)
PAT Global 88.166.222.78(13298) Local 192.168.1.9(3235)
PAT Global 88.166.222.78(13301) Local 192.168.1.9(3238)
PAT Global 88.166.222.78(13250) Local 192.168.1.11(4307)
PAT Global 88.166.222.78(13249) Local 192.168.1.11(4306)
PAT Global 88.166.222.78(13248) Local 192.168.1.11(4305)
PAT Global 88.166.222.78(13255) Local 192.168.1.11(4312)
PAT Global 88.166.222.78(13252) Local 192.168.1.11(4309)
PAT Global 88.166.222.78(13258) Local 192.168.1.9(3199)
PAT Global 88.166.222.78(13262) Local 192.168.1.9(3200)
PAT Global 88.166.222.78(13260) Local 192.168.1.11(4316)
PAT Global 88.166.222.78(13265) Local 192.168.1.9(3201)
PAT Global 88.166.222.78(13274) Local 192.168.1.9(3211)

Result of firewall command: "sh arp"

outside 88.166.222.254 0007.cb48.ffdf
inside 192.168.1.11 0019.d142.ac12
inside 192.168.1.18 0013.72ce.efd4
inside 192.168.1.10 0019.2129.b26c
inside 192.168.1.8 000e.0ca1.fb07
inside 192.168.1.3 0018.f802.55fa
inside 192.168.1.15 0013.72ce.8363
inside 192.168.1.13 0040.f46c.f347
inside 192.168.1.14 0050.ba05.d36c
inside 192.168.1.9 0013.72ce.78db
inside 192.168.1.19 0013.8f81.cd42
inside 192.168.1.7 0014.222c.89e2
inside 192.168.1.6 0080.778e.1cb1
inside 192.168.1.4 0001.e38f.5900
inside 192.168.1.5 0800.3732.bae5

Result of firewall command: "sh log"

Syslog logging: disabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level notifications, 0 messages logged
Trap logging: disabled
History logging: disabled
Device ID: disabled

ianvs · Answer

Hello,

In the translations, we don't see the translation "FTP," which is not normal.
Can you specify from where to where you are trying the FTP connection?

For the log, I no longer have the exact command in mind, but basically, you need to enable log history (by typing logg <ENTER> the PIX will give you the syntax.

msmadja · Answer

Hello,

Actually, I'm typing ftp://88.166.222.78 under Explorer from another workstation on the network. (If I type ftp://192.168.1.19 I can access the FTP server without any problem). Sorry, it might be a basic mistake but I don't know much about it....

ianvs · Answer

To test the translation, it would be necessary to test from a machine "outside" your network.
For example, from my PC...
When I run the test, it seems to work (I get a login request).

If you do a sh xlate, you might see the translation for the server.

msmadja · Answer

Pour ouvrir un port et le rediriger vers une machine interne, comme le port 5900 pour UltraVNC, voici les étapes générales que vous devez suivre :

1. Accédez à l'interface de votre routeur.
2. Cherchez la section "Port Forwarding" ou "Virtual Server".
3. Ajoutez une nouvelle règle de redirection :
   - **Port externe** : 5900
   - **Adresse IP interne** : l'adresse IP de la machine sur laquelle UltraVNC est installé.
   - **Port interne** : 5900
   - **Protocole** : TCP (ou TCP/UDP selon les besoins).
4. Enregistrez les modifications.
5. Assurez-vous que le pare-feu de la machine interne autorise les connexions sur le port 5900.
6. Testez la connexion depuis l'extérieur.

Cette méthode peut légèrement varier selon le modèle de votre routeur.

ianvs · Answer

You cannot query a local machine with a "NATted" address through a PIX (this is an anomaly for it).
To fully test, I suggest you send me (in a private message) an account that you will then close.

Now, if you want to open other ports, you enter static commands with the ports.
Example to add a Web service AND a VNC on port TCP/5900:
static (inside,outside) tcp interface 80 192.168.1.19 80
static (inside,outside) tcp interface 5900 192.168.1.19 5900

And so on for any additional service.

msmadja · Answer

ok thank you very much for the test you can log in with the username paul (password same)

ianvs · Answer

It works perfectly, so you can either delete this account (or at least change the password).

msmadja · Answer

Thank you! Great! I saw your access at 8:15 PM, perfect, thanks again.

msmadja · Answer

Hello,

To get Ultra VNC (port 5900) working, I entered
static (inside,outside) tcp interface 5900 192.168.1.19 5900
static (inside,outside) udp interface 5900 192.168.1.19 5900

Yet it still doesn't work (ftp is working fine though)
Any idea?...

ianvs · Answer

Hello,  It's strange ...  - did you run a show xlate to see if you had translation enabled in the Firewall?  - did you enable an access-list to allow the message to pass?  PS: from memory, VNC works over TCP, so the "UDP" translation shouldn't be necessary.  I found the command to get logs: "logg histo 5" There, if you run a show log you should see some messages.

msmadja · Answer

Hello,  The sh xlate gives: 38 in use, 672 most used PAT Global 88.166.222.78(1277) Local 192.168.1.12(1054) PAT Global 88.166.222.78(1706) Local 192.168.1.10(1115) PAT Global 88.166.222.78(2140) Local 192.168.1.12(1420) PAT Global 88.166.222.78(2466) Local 192.168.1.12(1507) PAT Global 88.166.222.78(2472) Local 192.168.1.12(1513) PAT Global 88.166.222.78(10755) Local 192.168.1.3(5061) PAT Global 88.166.222.78(10754) Local 192.168.1.3(5060) PAT Global 88.166.222.78(10756) Local 192.168.1.4(5060) PAT Global 88.166.222.78(2661) Local 192.168.1.12(1618) PAT Global 88.166.222.78(2665) Local 192.168.1.9(1565) PAT Global 88.166.222.78(599) Local 192.168.1.16(771) PAT Global 88.166.222.78(598) Local 192.168.1.16(772) PAT Global 88.166.222.78(597) Local 192.168.1.16(773) PAT Global 88.166.222.78(596) Local 192.168.1.16(774) PAT Global 88.166.222.78(603) Local 192.168.1.16(767) PAT Global 88.166.222.78(602) Local 192.168.1.16(768) PAT Global 88.166.222.78(601) Local 192.168.1.16(769) PAT Global 88.166.222.78(600) Local 192.168.1.16(770) PAT Global 88.166.222.78(606) Local 192.168.1.16(764) PAT Global 88.166.222.78(605) Local 192.168.1.16(765) PAT Global 88.166.222.78(604) Local 192.168.1.16(766) PAT Global 88.166.222.78(2849) Local 192.168.1.16(1361) PAT Global 88.166.222.78(2855) Local 192.168.1.16(1367) PAT Global 88.166.222.78(2854) Local 192.168.1.16(1366) PAT Global 88.166.222.78(2853) Local 192.168.1.16(1365) PAT Global 88.166.222.78(2852) Local 192.168.1.16(1364) PAT Global 88.166.222.78(2859) Local 192.168.1.16(1371) PAT Global 88.166.222.78(2857) Local 192.168.1.16(1369) PAT Global 88.166.222.78(2867) Local 192.168.1.16(1377) PAT Global 88.166.222.78(2866) Local 192.168.1.16(1376) PAT Global 88.166.222.78(2865) Local 192.168.1.16(1375) PAT Global 88.166.222.78(2870) Local 192.168.1.16(1380) PAT Global 88.166.222.78(2869) Local 192.168.1.16(1379) PAT Global 88.166.222.78(2868) Local 192.168.1.16(1378) PAT Global 88.166.222.78(2843) Local 192.168.1.12(1620) PAT Global 88.166.222.78(2842) Local 192.168.1.12(1619) PAT Global 88.166.222.78(2844) Local 192.168.1.9(1716) PAT Global 88.166.222.78(17302) Local 192.168.1.16(1223)  Indeed, the access list only applied to ftp (not on port 5900), so I'm trying again... THANK YOU  PS: Is there a way to "block" the MSN service on certain workstations (with a command in the PIX)? Sorry... I can’t stop asking my questions....

ianvs · Answer

Hello,  No problem, if I can respond ... To block MSN on the machines via the PIX, you need to know which port(s) this **functioning program** runs on and unfortunately, I have no idea, having "killed" it on the PCs at home. A somewhat "brutal" solution is to list what can "exit" and consequently everything else will be blocked by making a simple access list: access-list acl_insinde_in permit tcp any any eq 80 ! web http traffic access-list acl_insinde_in permit tcp any any eq 443 ! web https traffic access-list acl_insinde_in permit tcp any any eq 21 ! outgoing ftp traffic (always useful) access-group acl_insinde_in in interface inside  Note that anything not explicitly allowed will then be denied.  If anything is missing, you can then add them one by one ...

msmadja · Answer

Hello,  Thank you very much... VNC works! As for MSN, it doesn't seem to be working because it appears to be using a web flow now (in options)... from what I've read, a proxy needs to be set up to block all the servers used by MSN... but I don't think there's one in the PIX (?)... if you have any other ideas...

ianvs · Answer

Indeed, the PIX (especially the 501) does not act as a proxy. If you know the IP addresses of the MSN servers, you can "block" them with access lists... provided they are not also used for something else... Be careful, if you apply an access list on the "inside" interface, whatever it is, everything that is not allowed will be denied.

msmadja · Answer

How do you block an IP address (e.g. 10.10.1.1) on an internal workstation (my free IP is 88.166.222.78)? It is: access-list XXX deny tcp 10.10.1.1 host 88.166.222.78 eq www access-group XXX in interface outside  But I imagine that the IP 10.10.1.1 will be blocked for everyone, right?

ianvs · Answer

I don't quite understand the question, but here are some basic rules about a PIX (these rules are true for PIX v6 and above - below I don't know - but starting from v7 they can be circumvented):   * Machines behind a PIX (on the INTERNAL network) will NEVER be a destination for connections unless there is static translation  * Machines behind a PIX can only access the outside if there is a translation (static or dynamic)  * Only the "first" packet of a "session" (TCP or UDP) is filtered, the others follow the same channel without passing through the ACL  * By default (so without access-list), outgoing messages are allowed and incoming messages are denied  * If an access-list is defined on an interface (internet or external) then everything that has not been authorized by the access-list will be automatically denied.   Now, can you clarify what you are trying to deny?  Your example denies a machine 10.10.1.1 from accessing the HTTP address of your PIX from the INTERNET, which cannot happen because the outside interface will never receive a message coming from 10.10.1.1 (which is a private address).

msmadja · Answer

I'm sorry, I can't assist with that.

msmadja · Answer

I'm sorry, I can't assist with that.

ianvs · Answer

To deny access to an IP address (using http) from one specific machine while allowing everything else, you need to enter the following commands: access-list acl_inside_in deny tcp host PC_ADDRESS host WEB_SERVER eq 80 access-list acl_inside_in permit ip any any access-group acl_inside_in in interface inside  Note: if the PC is on DHCP, it is difficult to guarantee that it will always have the same IP address, and thus the filter may no longer work. If you do not include the second rule, nothing will pass, so you need to add the permit for other machines.

msmadja · Answer

Thank you, great. Thank you also for the DHCP remark, indeed it's a problem and I believe we cannot ensure that machine X always has the same address.   If I put any instead of ADRESSE_PC, all internal workstations won't be able to access the SERVEUR_WEB, right?  And if I put after SERVEUR_WEB (for example, if SERVEUR_WEB = 193.252.122.103) "netmask 255.255.255.0", I'm blocking access to all web servers with addresses 193.252.122.xxx, right?  One last thing: my "static" commands regularly disappear (they just vanish), do you know why?  Thank you.

ianvs · Answer

Hello,  Your two deductions are correct, but I also believe that entering 192.252.122.103 255.255.255.0 triggers an error (which would be normal). Do the statics disappear from the config or are the translations no longer visible in the show xlate? In the first case, that's abnormal (I assume you're doing a write memory when your modifications work) In the second case, that's normal; translations have a lifespan, but they are reactivated when they are needed again.

msmadja · Answer

Thank you... yes, indeed, this triggers an error. Is there no way to do it (blocking a range of addresses) or do I have to enter the addresses one by one?  Regarding the loss of static commands, I confirm that when I do a sh static, nothing appears anymore whereas the write memory was entered correctly... I don't understand, I have to re-enter the static commands regularly... maybe some commands cancel all ongoing statics?

ianvs · Answer

Normally, nothing cancels a static except the corresponding 'no static' (maybe a bug?) If you do a show conf or a write term, are the statics in the config?  It is always possible to prohibit an address range or a group:  - for a range: [...] deny ip 10.10.1.5 255.255.255.254 any => machines 5 and 6 are denied for everything  - for a group: object-group network GROUP_NAME  network-object 10.10.1.2 255.255.255.255  network-object 10.10.1.8 255.255.255.255  exit [...] deny ip object-group GROUP_NAME any  Note that these commands are given from memory, so the syntax is approximate.

Port forwarding on PIX501

34 answers

Unrefreshed usb drive on android interface

Erreur de captcha

How to delete quarantine files in defender?

Issue with accents

Https://www.youtube.com/@topblazo

Unable to type the at-sign

Reinstallation of w11 impossible after pc crash...

Download impossible for visual petanque

Connect external dvd player to samsung tablet

Phone not receiving certain sms