New to 501 pix

Question

Hey gang-
I'm a CNE, MCSE and CCNA; been teaching networking for 15 years. Trying to learn the 501 to teach it in the fall. It's a LOT harder than I had hoped it would be.....
I have two laptops connected to the pix. PC1 is on the inside interface, PC2 is on the outside. They can both ping their local interfaces in the pix.
I also have an FTP server connected to the pix's switch. The pix can ping the FTP server.
I did a factory reset, so everything is at defaults except for the outside address. I installed a new 6.3.4 O/S and version 3.0.3 of the PDM. Here's the show run:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxx encrypted
passwd xxxx
encrypted
hostname pixfirewall
domain-name ciscopix.com
names
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 175.x.x.1 255.255.0.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:xxxx
: end
When I create a static map between the inside and outside interfaces, I can connect from the outside laptop (PC2) to the FTP server. Fine. When I try to create a PAT connection using the PDM I get:
"This static port mapping translation rule is overlapping with a dynamic address translation rule for inside:0.0.0.0/0.0.0.0(any) using global pool 1. Do you wish to proceed?".
If I do so, it adds this to the running config:
static (inside,outside) tcp interface 21 192.168.1.200 21 netmask 255.255.255.255 0 0
I then created an allow-everything ACL using the PDM. It pasted to the pix as:
access-list outside_access_in line 1 permit ip any any
access-group outside_access_in in interface outside
20 minutes later.....
Well, things actually seem to be working now, as they should! First time in 20 hours of playing with this. However, does anyone know why I'm getting this message of overlapping translation rule? When I enter the same rule at the CLI, I do NOT get any error message.
Also, in the static command, there always seems to be a "0 0" at the end. What does that mean?
thanks much...
dave s.

Answer 1

Dave,
The 0 0 at the end of the static command is
max_connections and embryodic limit. If you wanted to change these values for your ftp server, do it here.
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#wp1026694
Here is another link for pix 6.3 commands:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/qref.htm
In reguards to the overlap, the nat(inside) 1 0 0 says nat eveything "inside" of which 192.168.1.200 is a part of. Hence the overlap. I don't think the pix will have a problem. I believe the order for making a translation slot is such that the static is used first.
I would change the outside_access_in to: permit tcp any host interface outside eq ftp
or something similar
permit ip any any isn't much of a firewall
Bob