Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm sure this is simple but how do you open a port on a cisco firewall?

I want to use fixup to alias a port and then actually open the port. But I don't know how to do it. Thank you.

share|improve this question
Which type of firewall? The process is different for a Pix or an ASA. – Satanicpuppy May 19 '10 at 13:43
pix 515e is the model 6.1(2) – johnny May 19 '10 at 14:17
what do you mean by 'alias a port'? – Zypher May 19 '10 at 15:10
I don't think fixup does what you think it does:… – Scott Pack May 19 '10 at 15:32 can i just open port 1701? – johnny May 19 '10 at 15:50

From the "priviledged configuration" command prompt:

static (inside_interface_name,outside_interface_name) (external ip address) (internal ip address)

access-list (access list name) ("permit" or "deny") (tcp or udp) any host (external_ip) eq (port number)

access-group (access list name) in interface (outside_interface)

Simple, right?

Good old Cisco.

The "Static" command tells the pix that the internal machine is attached to the external address, so that it will route traffic accordingly.

The "access-list" command tells the pix that you're creating a new access-list, you're allowing or denying "any" external machine to talk to your new external address on (port number) using tcp or udp packets.

The access-group command associates that access-list with an interface on the pix.

Here is a link to Cisco's Pix Command Reference for Commands starting with A. You can refer to that, if you need to. There is an example command under "access-group".

To wholly open a port for any machine you should do:

access-list open_port_whatever permit tcp any any eq (port number)
access-group open_port_whatever in interface (outside)
share|improve this answer
"Port 1701" implies L2TP. @johnny are you trying to pass PPTP through the firewall? If so, you'll have to allow GRE as well.… – Gerald Combs May 19 '10 at 16:01
You need to be in config mode not priviledged mode (en <cr>;conf t<cr> instead of just en<cr>) – Zypher May 19 '10 at 16:25
@gerald. yes. I opened the port and am trying to vpn from my xp machine. What I don't understand is why it gives no hitcount for the ports 1701 or 1723 (I opened both). It doesn't work but I'd be happy for the moment if I at least got a hitcount. – johnny May 19 '10 at 20:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.