IP Mapping Does Not Work! 2

[wstran]

Hi all,

Sorry for asking again. Last week I asked a question about my router-pix setup and I got replies from LloydSev and Lgarner on how to do it. However, even with their great advices, my web server still could not be accessed from internet. The following is my network diagram again and I want the internet users point to 66.45.102.226 in order to access my web server with internal private IP 192.168.7.2

ISP Internet
|
| 66.45.102.112 (First static IP address from ISP)
Router 3700
| 10.10.10.1
|
| 10.10.10.2 (outside)
PIX 515E
| 192.168.7.1 (dmz)
|
|
Web server 66.45.102.226 (Second static IP address from ISP)
192.168.7.2 (internal IP address)

and the following are my router and pix configurations:

**************************
Current configuration : 2491 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
no service dhcp
!
hostname router
!
boot-start-marker
boot-end-marker
no aaa new-model
ip subnet-zero
no ip source-route
!
!
ip cef
no ip domain lookup
ip domain name test.com
!
no ip bootp server
!
!
!
!
interface FastEthernet0/0
ip address 10.10.10.1 255.255.255.0
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip nat inside
no ip mroute-cache
duplex auto
speed auto
no cdp enable
!
interface Serial0/0
no ip address
shutdown
clockrate 2000000
no cdp enable
!
interface FastEthernet0/1
ip address 66.45.102.112 255.255.255.0
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip nat outside
no ip mroute-cache
duplex auto
speed auto
no cdp enable
!
interface Serial0/1
no ip address
shutdown
clockrate 2000000
no cdp enable
!
ip nat inside source list 120 interface FastEthernet0/0 overload
ip nat inside source static 10.10.10.3 66.45.102.226
no ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 66.45.102.1
ip route 192.168.7.0 255.255.255.0 10.10.10.2
!
!
no cdp run
!
line con 0
password 7 403T05521259872F3256
login
transport preferred all
transport output all
line aux 0
exec-timeout 0 10
password 7 016859C5A45H8759C65478
login
no exec
transport preferred all
transport output none
line vty 0 4
exec-timeout 5 0
password 7 403T05521259872F3256
login local
transport preferred all
transport input all
transport output all
!
end

*************************************************

PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
interface ethernet3 100full
interface ethernet4 100full
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 e2 security90
nameif ethernet3 dmz security50
nameif ethernet4 e4 security75
nameif ethernet5 e5unused security20
enable password juDTf/dYh8Rt6ihg encrypted
passwd juDTf/dYh8Rt6ihg encrypted
hostname PIX
domain-name test.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_in permit tcp any host 10.10.10.3 eq www
pager lines 24
mtu outside 1500
mtu inside 1500
mtu e2 1500
mtu dmz 1500
mtu e4 1500
mtu e5unused 1500
ip address outside 10.10.10.2 255.255.255.0
ip address inside 204.166.146.211 255.255.255.0
ip address e2 192.168.2.1 255.255.255.0
ip address dmz 192.168.7.1 255.255.255.0
ip address e4 192.168.4.1 255.255.255.0
ip address e5unused 127.0.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.7.0 255.255.255.0 0 0
static (dmz,outside) 10.10.10.3 192.168.7.2 netmask 255.255.255.255 0 0
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.10.10.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
console timeout 0
terminal width 80
: end

 

[martinp05]

Hello!

Ok, I think the static (dmz,outside) ist right.

So the Webservers internal ip will be transfert into the 10.10.10.3 IP-Address.

After that your router must make a second nat from the public-ip Web server 66.45.102.226 to this internal ip 10.10.10.3.

So the packet, coming from the internet to 66.45.102.226 will be nattet from the router to 10.10.10.3. Then the PIX will nat this ip to the internal ip of the webserver.

Thats it.

Martin

----------------------------------
Martin Peinsipp, Austria
CCSA,
IT-Security-Administrator

 

[wstran]

Thanks Martin. That is exactly what I am trying to achieve but somehow it did not work. Could you please check my router's and pix's configurations to see if there is any thing wrong? Your help is always appreciated!

wstran

 

[martinp05]

hello,

ip nat inside source static 10.10.10.3 66.45.102.226 --> ok you make the nat

ip nat inside --> this applies the nat-command to the internal interface, i think you did this in the right way.

the default gateway of the pix is the router?
can you do a debug on the inside interface on the router. then we can see, if the packets are going through the router and the packets are going back to the router.

then make a debug on the outside interface of the router, then we can see, if the packets are leaving the router.

martin


----------------------------------
Martin Peinsipp, Austria
CCSA,
IT-Security-Administrator

 

[martinp05]

hello,

when i try to establish a connection to: 66.45.102.226 (i did a

http://66.45.102.226)

i can see the following text in my browser:

hire.com, non-e-recruiter index page,
seeing this page probably means you did not type a filly qualified hostname into your browser...


maybe there is an other problem????

martin

----------------------------------
Martin Peinsipp, Austria
CCSA,
IT-Security-Administrator

 

[wstran]

I just found out that I CAN access to my web server from any computer with IP address 66.45.102.xxx (same domain with the web server 66.45.102.226). This means to me that the NAT on both router and pix are correct; however I CAN NOT get into my web server by computers with any other IP addresses. Any help is always appreciated.

 

[LloydSev]

that would sound like an issue from the ISP.. as the public IPs are all routed by the ISP, so anything on the internal side of the ISP can get to your page, but anything external to the ISP or on their WAN side can not..

However, maybe I am misinterpreting things.

Computer/Network Technician
CCNA