PIX NAT and STATIC commands

Similar Questions

• Clarification of authentication PIX NAT and BGP

  Hi all

  I did some tests on PIX and crossing this area of BGP traffic.

  When I configure the PIX to do no config NAT (NAT 0) and configure a BGP session between two routers (one inside) and the other on the outside net everything works fine.

  When I configure BGP authentication, I may add the keyword "norandomseq" NAT and STATIC commands cause BGP auth embedded TCP header for authentication information. It's OK.

  But when I reconfigure the PIX to make real NAT between the inside and the outside network and reconfigure my routers, BGP session doesn't happen if BGP authentication has been disabled. If I enable authentication BGP, I had errors of MD5 authentication on routers. (Note "norandomseq" is enabled for NAT and STATIC instructions)

  Now my question is BGP unsupported for NAT on PIX sessions? (for my tests, it has worked for NAT 0 config, also all the examples that I always found working with NAT 0 config)

  I think the problem is that the TCP pseudo-header changes to the NAT device and therefore it will never work right? Or is there any correction internal bgp which should fix this? I think it's almost impossible that this is known with the password simple bgp, right?

  Concerning

  Michael

  Your reasoning is dead the. BGP authentication works like this: the sending peer BGP takes and MD5 hash of the TCP header before sending the package and includes this hash in the TCP header option. The BGP receiver receives the packet and also did a MD5 hash of the TCP header. Then, it compares its value to the value sent by the sender of BGP. If they match, all right. If they fail, the packet is ignored and you get error messages, did you see.

  Because the NAT will change the address source TCP, the TCP header will be changed which should bring a different MD5 hash for the receiver that the sender originally sent.

  BGP peer by a PIX authtenticatio is supported only in a Nat 0 or static identity with the norandomseq option is enabled.

  Make sense?

  Scott

• IPSec Tunnel between Cisco 2801 and Netscren 50 with NAT and static

  Hello

  My problem isn't really the IPSec connection between two devices (it is already done...) But my problem is that I have a mail server on the site of Cisco, who have a static NAT from inside to outside. Due to the static NAT, I do not see the server in the VPN tunnel. I found a document that almost describes the problem:

  "Configuration of a router IPSEC Tunnel private-to-private network with NAT and static" (Document ID 14144)

  NAT takes place before the encryption verification!

  In this document, the solution is 'routing policy' using the loopback interface. But, how can I handle this with the Netscreen firewall. Someone has an idea?

  Thanks for any help

  Best regards

  Heiko

  Hello

  Try to change your static NAT with static NAT based policy.

  That is to say the static NAT should not be applicable for VPN traffic

  permissible static route map 1

  corresponds to the IP 104

  access-list 104 refuse host ip 10.1.110.10 10.1.0.0 255.255.0.0

  access-list 104 allow the host ip 10.1.110.10 all

  IP nat inside source static 10.1.110.10 81.222.33.90 map of static route

  HTH

  Kind regards

  GE.

• PIX, pat and static

  Hi all

  I have a pix connect my Internet when you run pat. (only a single public address)

  I would like to install a mail server on my private network.

  do I need a second public ip address or can I make a static with port 25 on the same ip address add that my global nat?

  Thanks in advance

  Hello

  You do not need another public address to the internal mail server. You can simply create a static port using the PAT address as the global address to the static. For example, something like this should work fine:

  static (inside, outside) tcp host 25 25

  I hope this helps.

  Scott

• Political L2L NAT and static NAT VPN

  Here's the scenario:  I'm to establish a VPN L2L.  When you try to determine who hosts inside my network access hosts on the remote network through the VPN, I can't get a straight answer from officials.

  My thought was to use a private network of 10.17.24.0/24 and NAT all hosts on my inside the network to 10.17.24.x.  As a side note, the hosts of my inner network can be on any subnet in the beach of 172.12.x.0.  I would then put 10.17.24.0/24 in my interesting traffic for my ACL crypto.  From the hosts inside my network need to browse Internet AND communicate with hosts on the remote network through the VPN, I was going to try to do this with policy NAT. is it possible to use NAT policy in this case?  Or what I need to use static? I start with static but could not navigate the Internet eventually.  I know I'm missing something with the static, but can not understand.  I'm still pretty new to all this stuff so please forgive my ignorance.

  For example:

  
  

  access-list allowed NAT1 host ip 172.21.1.1 REMOTEL2L_SUBNET
  access-list allowed NAT2 host ip 172.21.2.5 REMOTEL2L_SUBNET
  access-list allowed host ip 172.21.15.7 REMOTEL2L_SUBNET VIH3

  static (in, out) 10.17.24.1 access-list NAT1
  static (in, out) 10.17.24.2 access-list NAT2
  static (in, out) 10.17.24.3 access-list VIH3

  The above configuration will be NAT 172.21.1.1 to 10.17.24.1 when you go to the remote subnet (across the L2L).

  The same behavior for other hosts.

  The important thing is that the ACL for crypto will come from the address using a NAT:

  list of allowed VPN ip 10.17.24.1 REMOTEL2L_SUBNET host access
  list of allowed VPN ip 172.17.24.2 REMOTEL2L_SUBNET host access
  list of allowed VPN ip 172.17.24.3 REMOTEL2L_SUBNET host access

  Or just the whole subnet:

  VPN ip 172.17.24.0 access list allow 255.255.255.0 REMOTEL2L_SUBNET

  The important thing is that interesting traffic matches at both ends!

  In addition, you can still provide Internet and local as normally...

  Internet access:

  NAT (inside) 1 172.21.0.0 255.255.0.0

  Global 1 interface (outside)

  It will be useful.

  Federico.

• Removal of road static and led commands

  I can't seem to find it in the docs anywhere - how does one remove static, leads, and route commands on a Pix 515, v5.3? Can we simply type the word 'no', followed by the command?

  Thank you.

  Hello

  You can simply type "no" followed by the command. But you must be in config mode to do this.

  Kind regards

  Tom

• Static nat and NAT ACL 0

  All,

  I have nat 0 ACL indicating that an ip address should not be natted, while a static nat statement saying we need natted. I just want to know that we will have precedence.

  Thank you

  It is of the order of operations PIX nat / ASA.

  the NAT 0 acl_name (nameif) has priority.

  1 nat 0-list of access (free from nat)

  2. match the existing xlates

  3. match the static controls

  a. static NAT with no access list

  b. static PAT with no access list

  4. match orders nat

  a. nat [id] access-list (first match)

  b. nat [id] [address] [mask] (best match)

  i. If the ID is 0, create an xlate identity

  II. use global pool for dynamic NAT

  III. use global dynamic pool for PAT

• ASA 5500 and static NAT 1-to-1

  We currently have a pair of s ASA 5500 failover providing firewall & nat with inside, outside and the dmz interfaces. We do PAT interface for most of the internal to the external and static connections 1-to-1 NAT for specific hosts that need to accept connections from the outside inside. The space of the static nat is a 27 which includes the address of the external interface. It's that everything is working properly.

  However, we are out of space for the static NAT to this/27. I would like to be able to add a different network, probably another 27, for the more static NAT but I'm a hard time to find the best way to do it. Is this possible with a network that does not include the external interface on the ASA?

  Here are some of our current NAT config:

  Global interface 10 (external)

  NAT (inside) 10 0.0.0.0 0.0.0.0

  (dmz1, outside) static dmz1-net-net dmz1 netmask 255.255.255.224

  static (inside, dmz1) 192.168.0.0 192.168.0.0 netmask 255.255.0.0

  static (inside, dmz1) 10.0.0.0 10.0.0.0 netmask 255.0.0.0

  static (inside, outside) xx.yy.164.15 192.168.98.46 netmask 255.255.255.255

  static (inside, outside) xx.yy.164.8 192.168.98.47 netmask 255.255.255.255

  static (inside, outside) xx.yy.164.14 192.168.98.48 netmask 255.255.255.255

  static (inside, outside) xx.yy.164.13 192.168.101.50 netmask 255.255.255.255

  Thank you very much...

  Hello

  The correct syntax for the proxyarp activation will be

  No outside sysopt noproxyarp

  http://www.Cisco.com/en/us/products/ps6120/products_command_reference_chapter09186a00805fb9e9.html#wp1111405

• no nat without static configuration?

  I've dealt with pix for nearly 2 years and always thought of myself as a beginner at home.

  Can someone take a look at the configuration below and tell me if this Setup will work?

  Basically it's a completely private network, no nat and network access control (until my client has finalize their security policy)

  The configuration of my previous pix of work used static commands, ACL, but I thought that the configuration below does not have any command static since I have applied ACL on each pix interface and completely disable NAT.

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  nameif dmz security80 ethernet2

  nameif ethernet3 dev security60

  nameif ethernet4 ras security40

  ethernet5 failover security20 nameif

  external IP 10.3.0.2 255.255.255.0

  IP address inside 10.0.1.1 255.255.255.0

  10.5.0.1 dmz IP address 255.255.255.0

  IP address dev 10.1.4.1 255.255.255.0

  IP ras address 10.9.0.1 255.255.0.0

  172.16.0.1 IP address failover 255.255.255.0

  no-nat-all of the ip access list allow a whole

  access list outside-acl permit ip 10.0.0.0 255.0.0.0 10.5.0.0 255.255.255.0

  access list acl outside ip 10.6.0.0 allow 255.255.0.0 10.1.4.0 255.255.255.0

  access list outside-acl deny ip 10.0.0.0 255.0.0.0 10.1.4.0 255.255.255.0

  access list acl outside ip allow any 10.1.4.0 255.255.255.0

  access to the Interior-acl ip 10.0.1.0 list allow 255.255.255.0 10.5.0.0 255.255.255.0

  access to the Interior-acl ip 10.0.1.0 list allow 255.255.255.0 10.1.4.0 255.255.255.0

  10.1.4.0 IP Access-list dev - acl 255.255.255.0 allow 10.0.1.0 255.255.255.0

  10.1.4.0 IP Access-list dev - acl 255.255.255.0 allow 10.5.0.0 255.255.255.0

  Allow Access-list dev - acl 255.255.255.0 10.1.4.0 IP 10.9.0.0 255.255.0.0

  10.1.4.0 IP Access-list dev - acl 255.255.255.0 allow 10.6.0.0 255.255.255.0

  Allow Access-list dev - acl icmp a whole

  access-list dev - acl deny ip 10.1.4.0 255.255.255.0 10.0.0.0 255.0.0.0

  dev - ip access list acl allow a whole

  DMZ - acl access-list deny ip 10.5.0.0 255.255.255.0 10.6.0.0 255.255.255.0

  DMZ - acl access-list deny ip 10.5.0.0 255.255.255.0 10.9.0.0 255.255.255.0

  DMZ - acl access-list allowed 10.5.0.0 ip 255.255.255.0 10.0.0.0 255.0.0.0

  DMZ - acl access-list deny ip any one

  ras - acl 10.9.0.0 ip access list allow 255.255.0.0 10.1.4.0 255.255.255.0

  NAT (outside) - access list 0 non-nat-all

  NAT (inside) - access list 0 non-nat-all

  NAT (dmz) 0-list of no-nat-all access

  NAT (dev) 0-list of no-nat-all access

  (Ras) NAT 0-list of no-nat-all access

  Access-group acl outside in external interface

  group-access Interior-acl in the interface inside

  Access-group dmz - acl in the dmz interface

  Access-group dev - acl in interface dev

  Access-group acl ras flush with the interface

  Route outside 0.0.0.0 0.0.0.0 10.3.0.254 1

  Hello

  This configuration seems perfectly fine. You can use either static or NAT 0 with access to access the interface more list high. It's exactly what you're doing.

  Rgds,

  Desh

• DNS and static translations

  I have a web server on my dmz. On the demilitarized zone, the computers cannot be accessed by name. The problem is that DNS returns the ip (real) outside. I need the demilitarized zone to translate it into a local ip address. I use the MDP so I'm not using aliases. Any help would be appreciated.

  You can do this with the [static] commands and the "dns" option

  static (dmz, outside) 123.123.123.123 192.168.1.1 dns netmask 255.255.255.255 [keyword dns tells the pix to DNS doctoring for this translation because DNS resolves the public IP address]

  static (dmz, inside) 123.123.123.123 192.168.1.1 subnet 255.255.255.255 mask [allows the internal hosts to connect to the public IP found in DNS and it translates the private IP on the way to the demilitarized zone]

  Make sure you do a [clear xlate] after the changes.

  If you are running under 6.2, you will have to make any [alias] on the Pix.

• VPN site to Site with NAT and Port forwarding on a 871

  Hello

  Could someone please look at the config 871 router attached and tell me where I'm wrong!

  VPNs all work, work, BUT anyone trying to connect to a port that is sent through the VPN port forwarding fails.

  In the config attached Port 3389 (RDP) is sent to an internal server, if you connect to the external interface Internet connection is made and it works well, but if someone tries to connect to the IP address internal to that same server through VPN, it does not.

  We've added commands to stop working on the lines VPN NAT, but these do not seem to work.

  What Miss me?

  Thank you in advance and I will adjudicate all useful responses.

  It is a common problem. Yes you added controls to prevent NAT to work above the tunnel, but your static nat port to port 3389 takes precedence over the generic nat command, and there not all orders top to prevent it is nat would be above the tunnel.

  I wrote an example configuration for this some time, see here for more details:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

  If all goes well, he explains everything. Note that it is for a general order static host, not a static port that you have, but the concept is exactly the same. Just add a statement roadmap on the end of your static command of the port, and this route map - will reference an ACL that denies are used when going up above the tunnel.

• Issue of ASA NAT and routing

  Hello

  I have a question about NAT and routing on the SAA. I'm relatively new to ASA and don't know if it works or not. I have a pool of public IP (209.x.x.x/28) that routes my ISP to the external interface of my ASA. IP was assigned address for the outside of the ASA is an address of 206.x.x.2/24 with a default GW of 206.x.x.1. I intend using NAT to allow my web/mail servers on the DMZ (192.168.x.x) use 209.x.x.x addresses. However, I do know how to make it work since I'm not arping on any interface for 209.x.x.x addresses as they will be sent to the 206.x.x.2 address by the ISP. Can I just set up a translation NAT (on the external interface?) of the 209.x.x.x on 192.168.x.x address and the ASA will figure it out?

  Thanks for the help.

  Todd

  The ASa will figure it out, he will answer ARP queries for all that he has set up in a "static" command As long as th PSIA routes 209.x.x.x directly to the ASA addresses then it should all work fine.

  You just need to add lines like the following:

  static (dmz, external) 209.x.x.x netmask 255.255.255.255 192.168.x.x

  for each of your internal servers in the DMZ. Then an access-list to allow only HTTP/SMTP/etc through these addresses 209.x.x.x.

  list of allowed inbound tcp access any host 209.x.x.x eq smtp

  list of allowed inbound tcp access any host 209.y.y.y eq http

  Access-group interface incoming outside

• PIX, PDM and AAA issues

  I have a PIX 520 in the laboratory running 6.3.3 and PDM 3.0. I tested AAA authentication and authorization to our ACS server and run into problems.

  I have two groups put in place on our ACS server. A group can be accessed freely, the other group is set to the top with a Shell command authorization set that limit orders so that they can watch the running-config and a few other things. Users of both groups can connect to the PDM or SSH/telnet/series in the unit and are authenticated and authorized correctly.

  The configuration below works fine, until I pull the ACS server off the network. Because it is not any backup authentication or authorization to order method I am dead in the water. When this happens, I can always connect via the serial console, by using the 'pix' username and password enable, I just cannot run the command 'Enable' mode privlieged or any other control besides. (I get an error "Permission has no orders").

  Here's a current configuration:

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + (inside) host 1.2.3.4 123456 timeout 5

  Console telnet authentication GANYMEDE AAA +.

  the AAA console ssh GANYMEDE authentication +.

  AAA authentication GANYMEDE serial console +.

  AAA authentication enable console GANYMEDE +.

  Console AAA authentication http GANYMEDE +.

  order of AAA for authorization GANYMEDE +.

  Is it possible to set up a backup method for approval of authentication and control? If not, is there any other way the problem I'm running into?

  Let me know if you need more info. Thank you!

  Hello

  Sorry, I missed this earlier. There is a failure on the PIX for this and we have an open enhancement request to add several methods of authorization to the PIX - CSCea04538. At this point, your best bet is to bug of your account team to get this feature added to the code of PIX to come. Sorry for the inconveinence.

  Scott

• PIX, IOS ipsec troubleshooting commands

  I'm checking isakmp and negotiate IPsec between a PIX 535 and a router in 1711, but do not have knowledge of the command to check the Phase 1 and Phase 2 on both devices. They ping each other, then connectivity is not a problem, but I have no evidence of the negotiations going on on the other end.

  Does anyone know what the ' see the #' orders are to check active negotiations of Phase 1 and Phase 2 between these boxes?

  Thank you

  Marc

  Hi Marc,

  The basic display orders are ' show crypto isakmp his ' ' show crypto ipsec his ' to show active sessions in search "QM-IDLE" on the isakmp his and active incoming and outgoing his on ipsec.

  Debugs is also useful for establishing where a problem might ask. "debug crypto isakmp" debug crypto ipsec' ''(router only) engine debug crypto.

  The following doc is a good source of info.

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_tech_note09186a00800949c5.shtml

  Good luck

  Paul.

• NAT and Site to site VPN

  Hi all

  We currently have a PIX in our local network. There is a Site to site VPN tunnel between this PIX and another network abroad.

  We have several networks in our local network.

  The VPN tunnel is on a single network: 192.50.175.0 / 24.

  and the network of the other site is:

  192.100.24.0 21

  Part of the configuration:

  inside_nat0_outbound ip 192.50.175.0 access list allow 255.255.255.0 192.100.24.0 255.255.248.0

  NAT (inside) 0-list of access inside_nat0_outbound

  As I said before, we have several networks.

  In particular, we have 192.50.160.0/24 too.

  And we would like that this network can use the VPN tunnel also.

  But the other site does not want to carry our another network in their LAN.

  They suggest we 192.50.160.0 NAT / 24 to an IP address on the 192.50.175.0 / 24, users in a network 192.50.160.0 / 24 can also use the VPN tunnel.

  Do you know if it is possible to do it with my PIX? And how?

  It's a PIX-515-DMZ, v6.3 (5).

  Any help would be appreciated!

  Thank you

  Good point. You can be good then.