Cisco Pix how to add an additional block of static ip addresses for nat?
- by Scott Szretter
I have a pix 501 with 5 static ip addresses. My isp just gave me 5 more. I am trying to figure out how to add the new block and then how to nat/open at least one of them to an inside machine.
So far, I named a new interface "intf2", ip range is 71.11.11.58 - 62 (gateway should 71.11.11.57)
imgsvr is the machine I want to nat to one of the (71.11.11.59) new ip addresses.
mail (.123) is an example of a machine that is mapped to the current existing 5 ip block (96.11.11.121 gate / 96.11.11.122-127) and working fine.
Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet0 vlan1 logical
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan1 intf2 security1
enable password xxxxxxxxx encrypted
passwd xxxxxxxxx encrypted
hostname xxxxxxxPIX
domain-name xxxxxxxxxxx
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
...snip...
name 192.168.10.13 mail
name 192.168.10.29 imgsvr
object-group network vpn1
network-object mail 255.255.255.255
access-list outside_access_in permit tcp any host 96.11.11.124 eq www
access-list outside_access_in permit tcp any host 96.11.11.124 eq https
access-list outside_access_in permit tcp any host 96.11.11.124 eq 3389
access-list outside_access_in permit tcp any host 96.11.11.123 eq https
access-list outside_access_in permit tcp any host 96.11.11.123 eq www
access-list outside_access_in permit tcp any host 96.11.11.125 eq smtp
access-list outside_access_in permit tcp any host 96.11.11.125 eq https
access-list outside_access_in permit tcp any host 96.11.11.125 eq 10443
access-list outside_access_in permit tcp any host 96.11.11.126 eq smtp
access-list outside_access_in permit tcp any host 96.11.11.126 eq https
access-list outside_access_in permit tcp any host 96.11.11.126 eq 10443
access-list outside_access_in deny ip any any
access-list inside_nat0_outbound permit ip 192.168.0.0 255.255.0.0 IPPool2 255.255.255.0
access-list inside_nat0_outbound permit ip 172.17.0.0 255.255.0.0 IPPool2 255.255.255.0
access-list inside_nat0_outbound permit ip 172.16.0.0 255.255.0.0 IPPool2 255.255.255.0
...snip...
access-list inside_access_in deny tcp any any eq smtp
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging buffered notifications
mtu outside 1500
mtu inside 1500
ip address outside 96.11.11.122 255.255.255.248
ip address inside 192.168.10.15 255.255.255.0
ip address intf2 71.11.11.58 255.255.255.248
ip audit info action alarm
ip audit attack action alarm
pdm location exchange 255.255.255.255 inside
pdm location mail 255.255.255.255 inside
pdm location IPPool2 255.255.255.0 outside
pdm location 96.11.11.122 255.255.255.255 inside
pdm location 192.168.10.1 255.255.255.255 inside
pdm location 192.168.10.6 255.255.255.255 inside
pdm location mail-gate1 255.255.255.255 inside
pdm location mail-gate2 255.255.255.255 inside
pdm location imgsvr 255.255.255.255 inside
pdm location 71.11.11.59 255.255.255.255 intf2
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 2 96.11.11.123
global (intf2) 3 interface
global (intf2) 4 71.11.11.59
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 2 mail 255.255.255.255 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 96.11.11.123 smtp mail smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp 96.11.11.123 https mail https netmask 255.255.255.255 0 0
static (inside,outside) tcp 96.11.11.123 www mail www netmask 255.255.255.255 0 0
static (inside,outside) 96.11.11.124 ts netmask 255.255.255.255 0 0
static (inside,outside) 96.11.11.126 mail-gate2 netmask 255.255.255.255 0 0
static (inside,outside) 96.11.11.125 mail-gate1 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 96.11.11.121 1
route intf2 0.0.0.0 0.0.0.0 71.11.11.57 2
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
floodguard enable
...snip...
: end
[OK]
Thanks!