Newsgroup: it.comp.reti.cisco
Titolo: Aiuto per nat su PIX 501

Ciao a tutti,
vi chiedo aiuto sul CISCO PIX 501... avevo configurato questo PIX per
fare due tunnel con altri due PIX remoti (GATEWAY TO GATEWAY) più
altri sei profili VPN per utenze dial-up (CLIENT TO GATEWAY) con i
vari Wizard. Tutto bello, tutto felice... adesso dovrei attivare del
nat: dovrei pubblicare all'esterno due sole porte di due host (ogni
host ha porte differenti naturalmente) sull'ip del fw. Mi dareste
qualche dritta (leggi comando)
In pratica vorrei che per il 192.168.0.12 fossero nattate le porte
8094 (tcp e udp) e 112 (tcp) ... il tutto per raggiungere da internet
(chiamando l'ip pubblico del fw) le porte 8094 e 112.
Lo stesso per il 192.168.0.13 porte 8095 (tcp e udp e ) 113 (tcp)
Grazie... ogni suggerimento sarà ben accetto.
Ganimede Dignan.
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXX encrypted
passwd XXX encrypted
hostname namepix01
domain-name 
meliconi.com
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.0.0 LAN
name 81.91.138.215 FW-SARA-DU
name 81.176.214.240 WAN
name 192.168.1.0 lan-ovm
name 192.168.2.0 lan-np
object-group network LAN
  network-object LAN 255.255.255.0
access-list inside_authentication_LOCAL permit tcp any any
access-list inside_access_in permit ip any any log
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.241
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.242
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.243
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.244
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.245
access-list inside_outbound_nat0_acl permit ip LAN 255.255.255.0 lan-
np 255.255.255.0
access-list inside_outbound_nat0_acl permit ip LAN 255.255.255.0 lan-
ovm 255.255.255.0
access-list inside_outbound_nat0_acl permit ip any host 192.168.0.240
access-list outside_cryptomap_10 permit ip LAN 255.255.255.0 lan-ovm
255.255.255.0
access-list outside_cryptomap_dyn_40 permit ip any host 192.168.0.241
access-list outside_cryptomap_dyn_60 permit ip any host 192.168.0.242
access-list outside_cryptomap_dyn_80 permit ip any host 192.168.0.243
access-list outside_cryptomap_dyn_100 permit ip any host 192.168.0.244
access-list outside_cryptomap_dyn_120 permit ip any host 192.168.0.245
access-list outside_cryptomap_dyn_20 permit ip any host 192.168.0.240
access-list outside_cryptomap_50 permit ip LAN 255.255.255.0 lan-np
255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside 81.176.214.242 255.255.255.248
ip address inside 192.168.0.254 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPOOL001 192.168.0.240 mask 255.255.255.255
ip local pool VPNPOOL002 192.168.0.241 mask 255.255.255.255
ip local pool VPNPOOL003 192.168.0.242 mask 255.255.255.255
ip local pool VPNPOOL004 192.168.0.243 mask 255.255.255.255
ip local pool VPNPOOL005 192.168.0.244 mask 255.255.255.255
ip local pool VPNPOOL006 192.168.0.245 mask 255.255.255.255
pdm location LAN 255.255.255.0 inside
pdm location FW-SARA-DU 255.255.255.255 outside
pdm location 192.168.0.240 255.255.255.255 outside
pdm location lan-ovm 255.255.255.0 outside
pdm location 217.172.4.109 255.255.255.255 outside
pdm location lan-np 255.255.255.0 outside
pdm location 192.168.0.246 255.255.255.255 outside
pdm group LAN inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 81.176.214.241 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication match inside_authentication_LOCAL inside LOCAL
aaa authorization command LOCAL
http server enable
http FW-SARA-DU 255.255.255.255 outside
http 217.172.4.109 255.255.255.255 outside
http LAN 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
auth-prompt prompt P
auth-prompt accept A
auth-prompt reject R
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set meliconi esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address
outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 40 match address
outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 60 match address
outside_cryptomap_dyn_60
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 80 match address
outside_cryptomap_dyn_80
crypto dynamic-map outside_dyn_map 80 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 100 match address
outside_cryptomap_dyn_100
crypto dynamic-map outside_dyn_map 100 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 120 match address
outside_cryptomap_dyn_120
crypto dynamic-map outside_dyn_map 120 set transform-set ESP-3DES-MD5
crypto map inside_map client authentication LOCAL
crypto map inside_map interface inside
crypto map outside_map 10 ipsec-isakmp
crypto map outside_map 10 match address outside_cryptomap_10
crypto map outside_map 10 set peer 88.34.236.18
crypto map outside_map 10 set transform-set meliconi
crypto map outside_map 50 ipsec-isakmp
crypto map outside_map 50 match address outside_cryptomap_50
crypto map outside_map 50 set peer 85.46.26.122
crypto map outside_map 50 set transform-set meliconi
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp enable inside
isakmp key ******** address 88.34.236.18 netmask 255.255.255.255 no-
xauth no-config-mode
isakmp key ******** address 85.46.26.122 netmask 255.255.255.255 no-
xauth no-config-mode
isakmp identity address
isakmp keepalive 3600
isakmp nat-traversal 3600
isakmp log 9999
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPNGRP001TDUI address-pool VPNPOOL001
vpngroup VPNGRP001TDUI idle-time 1800
vpngroup VPNGRP001TDUI password XXX
vpngroup VPNGRP002TDUI address-pool VPNPOOL002
vpngroup VPNGRP002TDUI idle-time 1800
vpngroup VPNGRP002TDUI password XXX
vpngroup VPNGRP003TDUI address-pool VPNPOOL003
vpngroup VPNGRP003TDUI idle-time 1800
vpngroup VPNGRP003TDUI password XXX
vpngroup VPNGRP004TDUI address-pool VPNPOOL004
vpngroup VPNGRP004TDUI idle-time 1800
vpngroup VPNGRP004TDUI password XXX
vpngroup VPNGRP005TDUI address-pool VPNPOOL005
vpngroup VPNGRP005TDUI idle-time 1800
vpngroup VPNGRP005TDUI password XXX
vpngroup VPNGRP006TDUI address-pool VPNPOOL006
vpngroup VPNGRP006TDUI idle-time 1800
vpngroup VPNGRP006TDUI password XXX
telnet timeout 5
ssh FW-SARA-DU 255.255.255.255 outside
ssh 217.172.4.109 255.255.255.255 outside
ssh LAN 255.255.255.0 inside
ssh timeout 5
management-access inside
console timeout 0
dhcpd dns 151.99.125.2 151.99.250.2
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain 
meliconi.com
dhcpd auto_config outside
username monitor password XXX encrypted privilege 3
username admin password XXX encrypted privilege 15
username resource password XXX encrypted privilege 5
username allarmi password XXX encrypted privilege 5
username alessandro password XXX encrypted privilege 15
terminal width 80
banner exec namepix01
banner login namepix01
Cryptochecksum:XXX
: end

Nessuno ?
vorrei piangere :-(
