• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

PIX Problem, "intra-interface"

S

Stinn

[H]ard|Gawd
Joined
Jul 13, 2001
Messages
1,796
Okay so we are doing some infrastructure changes and this means that my pix is now getting packets that it needs to route back out it's inside interface. From what I have found on Cisco's site this shouldn't be that hard, I guess I didn't read the fine print. Here's what is happening:
Computer A(10.10.10.10) is trying to talk to Computer B(10.11.11.11) the packet hits the Pix's inside interface, it knows the packet should go out the inside interface but it would drop it:
3 Nov 15 2007 15:43:04 305006 10.10.10.10 portmap translation creation failed for tcp src inside:10.11.11.11/1674 dst inside:10.10.10.10/8192

So I apply the intra-interface command: same-security-traffic permit inter-interface
which is what i expected to have to do, but didn't seem to make a lick of difference, so i find an article on cisco saying i need to do a global command(global (inside) 1 interface) to do what I want. That's okay, I do that, now the last thing I'm getting is a "No translation group found". I'm assuming I want to do a nat 0 command right? I feel like I'm so far off my original thing that I'm lost. Am I heading in the right direction?
I can quickly make a nat 0 command but I just want to check if this is the right direction.
Please help!
 
Does packet tracer show anything? What did you add to the routing table? Is there a router it's forwarding to? Could you post the config (minus passwords and external IPs)
 
The pix is running RIPv2 to get it's routing table. The routes all appear in there as they should. There are two routers, directly connected to the inside, one is mine and one is my ISPs(for our MPLS infrastructure).
I did my inside configuration like they recommended, however I'm now thinking I'll change that, since the problem is they are using my firewall as the next hop route for everything and I'd actually really rather not have that traffic hitting my firewall. I'm going to call them this morning and discuss putting my router as the next hop which should fix all these problems.
I actually have the setup working, sort of at least. Right now Computer A can RDP to Computer B but Computer B can't go back to Computer A. This obviously doesn't make any sense and I'm not seeing any logs about it on the PIX.
I walked away with it working like that last night as I just got tired of banging my head against the wall.
 
You must log in or register to reply here.
Back
Top