Firewall Wizards mailing list archives
Re: NAT a range of TCP ports to an internal IP address onpix 506E
From: "Fetch, Brandon" <bfetch () tpg com>
Date: Mon, 28 Jan 2008 16:41:05 -0500
More specifically - you're inbound NAT already encompasses port 80; the new one is a one-for-one NAT instead of more-specific ports. The added static must be: static (inside,outside) tcp x.x.x.x VoIP-port1 192.168.1.6 VoIP-port1 netmask 255.255.255.255 0 0 static (inside,outside) tcp x.x.x.x VoIP-port2 192.168.1.6 VoIP-port2 netmask 255.255.255.255 0 0 static (inside,outside) tcp x.x.x.x VoIP-port3 192.168.1.6 VoIP-port3 netmask 255.255.255.255 0 0 .... You can cheat/easily manage this better by creating an object-group; you can create one for protocols, networks, or services (IP ports). If you create an "object-group service" and specify your VoIP ports (TCP or UDP), your static could be one line instead of 62: static (inside,outside) tcp x.x.x.x object-group VoIP-Group 192.168.1.6 VoIP-Group netmask 255.255.255.255 0 0 This makes management easier since you don't have to input 62 lines of static configurations with the equivalent inbound ACL changes as well (you can use object-groups as part of any configuration task). HTH, Brandon -----Original Message----- From: firewall-wizards-bounces () listserv icsalabs com [mailto:firewall-wizards-bounces () listserv icsalabs com] On Behalf Of kevin horvath Sent: Thursday, January 24, 2008 9:18 PM To: Firewall Wizards Security Mailing List Subject: Re: [fw-wiz] NAT a range of TCP ports to an internal IP address onpix 506E you already have a translation. Do a "sh nat" and see where the conflict is and then remove or modify the translations. On Jan 23, 2008 1:50 PM, Chris Smith <chris.smith () 1pointe com> wrote:
Best regards firewall list readers! We have a Cisco pix 506E running software version 6.3 (5) We also have a VOIP server on the internal network at 192.168.1.6. We
need to NAT a range of TCP ports to this VOIP server. The port range is 49152 through 49214.
The connections come in from the internet and need to be natted
through the pix to this internal VOIP server.
We believe we already have the access list rules in place to allow the
connections. We just need a translation rule to allow this group of ports.
The IP address of the internal interface on the pix is 192.168.1.2 The command that is not working is: static (inside,outside) x.x.x.x 192.168.1.6 We are currently getting this error when trying to setup the rule. WARNING: mapped-address conflict with existing static tcp from inside:server/80 to outside:x.x.x.x/80 netmask
255.255.255.2
55 WARNING: mapped-address conflict with existing static tcp from inside:server/25 to outside:x.x.x.x/25 netmask
255.255.255.2
55 WARNING: mapped-address conflict with existing static tcp from inside:server/110 to outside:x.x.x.x/110 netmask
255.255.255
.255 Any insight is appreciated. Thanks to all. _______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards This message is intended only for the person(s) to which it is addressed and may contain privileged, confidential and/or insider information. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Any disclosure, copying, distribution, or the taking of any action concerning the contents of this message and any attachment(s) by anyone other than the named recipient(s) is strictly prohibited. _______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- NAT a range of TCP ports to an internal IP address on pix 506E Chris Smith (Jan 24)
- Re: NAT a range of TCP ports to an internal IP address on pix 506E kevin horvath (Jan 25)
- Re: NAT a range of TCP ports to an internal IP address onpix 506E Fetch, Brandon (Jan 30)
- Re: NAT a range of TCP ports to an internal IP address on pix 506E kevin horvath (Jan 25)