dslreports logo
site
spacer

spacer
 
    All FAQs Site FAQ DSL FAQ Cable Tech About DSL Distance DSL Hurdles »»
spc

spacer




how-to block ads



Suggested pre-reading:

»Cisco Forum FAQ »Router configuration to run server (with and without port forwarding)
»Cisco Forum FAQ »PIX Firewall/ASA configuration to run server (with and without port forwarding)

Introduction

There is typically NAT/PAT consideration to access the Internet from private network using Private IP addresses. As mentioned on the reading above, you must use Internet-routable (Public) IP address to go out to the Internet. Therefore there should be NAT/PAT process that translate Private IP address into Public IP address.

Since in this case there are two devices (router and ASA or PIX firewall), you must choose to use one to do such NAT/PAT process. Typically you want to have the ASA or PIX firewall to do the NAT/PAT process, especially when you do have the ASA or PIX firewall facing the Internet (ISP) directly.

In addition, there must be proper IP routing in place between devices and subnets. This way; the ISP, ASA or PIX firewall, router, and LAN users know how to reach each other and other subnets. For simple network, static routes as shown in the sample configuration should suffice.

As noted, the above links are suggested prerequisite reading since this sample configuration presents the next chapter of the prerequisite reading. In addition, you must have a familiarity of both older PIX OS commands and newer PIX/ASA OS commands; or at least familiar enough with the older PIX OS commands to configure PIX/ASA running newer OS commands. If you are new to CLI specifically for router, PIX, and ASA; then check out the following FAQ for info.

»Cisco Forum FAQ »The most straight-forward way to configure Cisco router: Introduction to CLI
»Cisco Forum FAQ »Straight-forward way to configure Cisco PIX Firewall/ASA: Introduction to CLI

Consideration

Typical network environment that might utilize following sample PIX configuration is as follows

* There is a modem in front of the PIX, which the modem connects to the ISP
* ISP is providing Public IP address to the PIX statically
* There is NAT/PAT in place on the PIX to translate internal IP addresses to the ISP-provided Public IP address
* The router behind the PIX is directly connected physically to the PIX LAN (inside) interface using crossover patch cable
* No devices (workstations, servers, switches, hubs) are sitting between the PIX and the router
* All the switches, workstations, and servers are sitting behind the router
* The router is acting as DHCP server, which provide dynamic IP info for hosts behind the router
* The router is not able to provide stateful firewall protection; hence PIX is setup in front of the router before connecting to the ISP (the modem) to protect your LAN from unauthorized accesses

This sample configuration assumes the followings:

* You receive a static IP address from ISP as 1.1.1.2
* The ISP default gateway is 1.1.1.1
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal webserver IP address is 192.168.100.1
* Your internal ftp server IP address is 192.168.100.2
* Your internal mail server IP address is 192.168.100.3
* You have syslog server with IP address of 192.168.100.5
* You use 1.1.1.2 (the PIX outside interface IP address) to be your three server's public IP address (static PAT)
* You permit only internal host of 192.168.100.4 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the router
* Since the PIX inside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

PIX Configuration

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ***** encrypted
passwd ***** encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 1.1.1.2 PUBLIC_IP_01
name 192.168.100.1 WEB_SERVER_01
name 192.168.100.2 FTP_SERVER_01
name 192.168.100.3 MAIL_SERVER_01
name 192.168.100.4 TERMINAL_SERVER_01
name 192.168.100.5 SYSLOG_SERVER_01
object-group icmp-type ICMP-INBOUND
description Allowable inbound ICMP traffic
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded
object-group service PUBLIC_SERVER-TCP tcp
description Allowable inbound TCP traffic
port-object range ftp-data ftp
port-object eq smtp
port-object eq www
access-list INBOUND permit icmp any host PUBLIC_IP_01 object-group ICMP-INBOUND
access-list INBOUND permit tcp any host PUBLIC_IP_01 object-group PUBLIC_SERVER-TCP
pager lines 24
logging on
logging trap informational
logging host inside SYSLOG_SERVER_01
mtu outside 1500
mtu inside 1500
ip address outside PUBLIC_IP_01 255.255.255.0
ip address inside 10.0.0.1 255.255.255.252
ip audit info action alarm
ip audit attack action alarm
pdm location TERMINAL_SERVER_01 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www WEB_SERVER_01 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp-data FTP_SERVER_01 ftp-data netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp FTP_SERVER_01 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp MAIL_SERVER_01 smtp netmask 255.255.255.255 0 0
access-group INBOUND in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
route inside 192.168.100.0 255.255.255.0 10.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http TERMINAL_SERVER_01 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet TERMINAL_SERVER_01 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
 

Router Configuration

service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable password 7 ******
!
no aaa new-model
ip subnet-zero
!
!
ip name-server 68.87.64.196
ip name-server 68.87.66.196
ip dhcp excluded-address 192.168.100.1 192.168.100.5
ip dhcp excluded-address 192.168.100.254
!
ip dhcp pool INSIDE-LAN
network 192.168.100.0 255.255.255.0
default-router 192.168.100.254
dns-server 68.87.64.196 68.87.66.196
!
no ip bootp server
ip cef
!
!
!
!
interface FastEthernet0
ip address 10.0.0.2 255.255.255.252
no ip redirects
no ip proxy-arp
speed auto
duplex auto
no cdp enable
!
interface FastEthernet1
ip address 192.168.100.254 255.255.255.0
no ip redirects
no ip proxy-arp
speed 100
full-duplex
no cdp enable
hold-queue 100 out
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.1
no ip http server
!
logging history warnings
logging 192.168.100.5
no cdp run
!
line con 0
line aux 0
line vty 0 4
exec-timeout 120 0
password 7 ******
login
!
end
 

Note:

* The PIX Firewall Inside and Router FastEthernet0 interfaces are within 10.0.0.0/30 network. This means there are no other devices within such network beside the PIX and the router. Sometimes there are other machines within this network where the PIX Inside and Router FastEthernet0 interfaces connect to a switch using straight-through cables. Other machines such as servers connect to the same switch. Since there are more devices, then typically the network is /24 size or larger (i.e. 10.0.0.0/24).

When this is the case, make sure that all of those machines have default gateway of 10.0.0.2 (the Router FastEthernet0 interface IP address) and not the 10.0.0.1 (the PIX Firewall Inside interface IP address). This way all the machines have ability to reach both any machines within 192.168.100.0/24 (the Inside LAN) and the Internet.

Some Discussions

»Port forward Cisco Router

More Sample Configurations

ASA 5505
ASA Version 8.4(7) 
!
hostname ciscoasa
domain-name bvn.local
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
 switchport access vlan 12
!
interface Ethernet0/5
!             
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif Management
 security-level 100
 no ip address
!
interface Vlan2
 nameif outside
 security-level 0
 pppoe client vpdn group DIALER-GROUP
 ip address pppoe setroute 
!
interface Vlan3
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.252 
!
interface Vlan12
 nameif DMZ
 security-level 50
 no ip address
!
boot system disk0:/asa847-k8.bin
ftp mode passive
dns server-group DefaultDNS
 name-server 8.8.8.8
 name-server 8.8.4.4
 domain-name bvn.local
 
object network obj-Inside-Network
 subnet 192.168.0.0 255.255.0.0
 
pager lines 24
logging asdm informational
mtu Management 1500
mtu outside 1492
mtu inside 1500
mtu DMZ 1500
mtu test 1500 
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-714.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
 
object network obj-Inside-Network
 nat (inside,outside) dynamic interface
 
route inside 192.168.0.0 255.255.0.0 192.168.0.2 1
 
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL 
aaa authentication ssh console LOCAL 
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group DIALER-GROUP request dialout pppoe
vpdn group DIALER-GROUP localname xxxxx
vpdn group DIALER-GROUP ppp authentication pap
vpdn username xxxxx password ***** store-local
 
dhcpd auto_config outside
!
!
tls-proxy maximum-session 24
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn        
 anyconnect-essentials
username admin password J.TJIa8ig6Y7fCBj encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:7473f9d7099ca0380fac148a144c7030
: end
 

A 2811 router
hostname R2811
!
boot-start-marker
boot system flash:/c2800nm-advipservicesk9-mz.124-15.T17.bin
boot-end-marker
!
logging buffered 4096
no logging console
no logging monitor
!
aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization exec default group radius local if-authenticated 
aaa authorization network default group radius local if-authenticated 
!
!
aaa session-id common
clock timezone gmt 7
dot11 syslog
!
!
ip cef
ip dhcp database flash:/dhcp_binding write-delay 60 timeout 10
ip dhcp database tftp://192.168.30.200/dhcp_binding write-delay 60 timeout 10
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.10.200 192.168.10.254
ip dhcp excluded-address 192.168.20.200 192.168.20.254
ip dhcp excluded-address 192.168.30.200 192.168.30.254
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp excluded-address 192.168.10.1 192.168.10.100
ip dhcp excluded-address 192.168.30.1 192.168.30.100
!
ip dhcp pool VLAN30
   network 192.168.30.0 255.255.255.0
   default-router 192.168.30.1 
   dns-server 8.8.8.8 
!
ip dhcp pool default
   network 192.168.10.0 255.255.255.0
   default-router 192.168.10.1 
   dns-server 8.8.8.8 
!
ip dhcp pool VLAN20
   network 192.168.20.0 255.255.255.0
   default-router 192.168.20.1 
   dns-server 8.8.8.8 
!
ip dhcp pool VLAN50
   network 192.168.50.0 255.255.255.0
   default-router 192.168.50.1 
   dns-server 8.8.8.8 
!
!
ip domain name bvn.local
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint my-trustpoint
 enrollment selfsigned
 subject-name O=IT,CN=www.bvn.local
 revocation-check crl
 rsakeypair my-rsa-keys
!
!
crypto pki certificate chain my-trustpoint
 certificate self-signed 02
  3082026F 308201D8 A0030201 02020102 300D0609 2A864886 F70D0101 04050030 
  45311630 14060355 0403130D 7777772E 62766E2E 6C6F6361 6C310B30 09060355 
  040A1302 4954311E 301C0609 2A864886 F70D0109 02160F52 32383131 2E62766E 
  2E6C6F63 616C301E 170D3133 31313137 30343535 34345A17 0D323030 31303130 
  30303030 305A3045 31163014 06035504 03130D77 77772E62 766E2E6C 6F63616C 
  310B3009 06035504 0A130249 54311E30 1C06092A 864886F7 0D010902 160F5232 
  3831312E 62766E2E 6C6F6361 6C30819F 300D0609 2A864886 F70D0101 01050003 
  818D0030 81890281 81008C50 B07554E2 256C1E2D F4DBA9B1 45CCE4CD 7A469780 
  A4A50706 50A24300 CD1CA5A7 B9388ACD AE9A1D66 1EA5FEA6 A26E48DC 7D06E733 
  E554146D 64E22EB5 30750CEB 67C0286A 12FBEFE5 BEF2BEBC E6849354 C31AF749 
  729BFA77 F081A88E E2420DC9 0BB0E827 CF6B885C 6DA8BEB8 002BBE30 76E134FB 
  BB5DADA7 455687AE 4B4F0203 010001A3 6F306D30 0F060355 1D130101 FF040530 
  030101FF 301A0603 551D1104 13301182 0F523238 31312E62 766E2E6C 6F63616C 
  301F0603 551D2304 18301680 14ECF478 D7A73A3C 3DB4A58F 072FD138 72A95737 
  9F301D06 03551D0E 04160414 ECF478D7 A73A3C3D B4A58F07 2FD13872 A957379F 
  300D0609 2A864886 F70D0101 04050003 8181002B 810C5936 F1C79ABE F58C6ACE 
  5CA04136 AF768927 CB2DC3F8 CBFA1A68 87054270 3557400C 47B0BB99 42A98A57 
  43202C33 89E06619 F527CDD4 029AA76B A8631AE7 65059A62 BDD1289D C1B83FFD 
  02432B90 E5671FBB ABE3F5E1 39D4B707 D8580226 E6C60148 2D22A5C4 40FA7809 
  151D66D3 497CE907 E62FA8CC A59A2645 D3D7CD
        quit
!
interface Loopback1
 no ip address
!
interface FastEthernet0/0
 description CONNECT to ASA
 ip address 192.168.0.2 255.255.255.252
 ip virtual-reassembly
 duplex full
 speed auto
!
interface FastEthernet0/1
 description LAN
 no ip address
 duplex full
 speed auto
 no cdp enable
!
interface FastEthernet0/1.1
 description DEFAULT
 encapsulation dot1Q 1 native
 ip virtual-reassembly
!
interface FastEthernet0/1.2
 description FINANCE_DEPT
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 ip virtual-reassembly
!
interface FastEthernet0/1.3
 description IT_DEPT
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 ip virtual-reassembly
!
interface FastEthernet0/1.4
 description HR_DEPT
 encapsulation dot1Q 40
 ip address 192.168.40.1 255.255.255.0
 ip virtual-reassembly
!
interface FastEthernet0/1.5
 encapsulation dot1Q 50
 ip address 192.168.50.1 255.255.255.0
 ip virtual-reassembly
!
!
ip forward-protocol nd
no ip forward-protocol udp tftp
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
no ip forward-protocol udp tacacs
 
ip route 0.0.0.0 0.0.0.0 192.168.0.1
!
!
ip http server
ip http authentication local
ip http secure-server
 
=================================
 

Some Discussion
»[HELP] Configuring My Cisco 1st Time

Expand got feedback?

by aryoba See Profile
last modified: 2014-05-20 13:58:18