1

I'm sure this is simple but how do you open a port on a cisco firewall?

I want to use fixup to alias a port and then actually open the port. But I don't know how to do it. Thank you.

5

1 Answer 1

1

From the "priviledged configuration" command prompt:

static (inside_interface_name,outside_interface_name) (external ip address) (internal ip address)

access-list (access list name) ("permit" or "deny") (tcp or udp) any host (external_ip) eq (port number)

access-group (access list name) in interface (outside_interface)

Simple, right?

Good old Cisco.

The "Static" command tells the pix that the internal machine is attached to the external address, so that it will route traffic accordingly.

The "access-list" command tells the pix that you're creating a new access-list, you're allowing or denying "any" external machine to talk to your new external address on (port number) using tcp or udp packets.

The access-group command associates that access-list with an interface on the pix.

Here is a link to Cisco's Pix Command Reference for Commands starting with A. You can refer to that, if you need to. There is an example command under "access-group".

To wholly open a port for any machine you should do:

access-list open_port_whatever permit tcp any any eq (port number)
access-group open_port_whatever in interface (outside)
3
  • "Port 1701" implies L2TP. @johnny are you trying to pass PPTP through the firewall? If so, you'll have to allow GRE as well. cisco.com/en/US/products/hw/vpndevc/ps2030/… May 19, 2010 at 16:01
  • You need to be in config mode not priviledged mode (en <cr>;conf t<cr> instead of just en<cr>)
    – Zypher
    May 19, 2010 at 16:25
  • @gerald. yes. I opened the port and am trying to vpn from my xp machine. What I don't understand is why it gives no hitcount for the ports 1701 or 1723 (I opened both). It doesn't work but I'd be happy for the moment if I at least got a hitcount.
    – johnny
    May 19, 2010 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .