Method Two – SMA Appliance on DMZ Interface

This method is optional and requires that the PIX have an unused third interface, such as a PIX 515, PIX 525, or PIX 535. We are using the default numbering scheme of the SMA appliance.

1. From a management system, log in to the SMA appliance’s Secure Mobile Access management interface. By default, the management interface is X0 and the default IP address is 192.168.200.1.
2. Navigate to the Network > Routes page and make sure the Default Gateway is set to 192.168.200.2. When done, click Accept in the upper-right corner to save and activate the change.
3. Navigate to the Clients >Settings > Client Addresses page. Enter 192.168.200.201 in the field next to Client Address Range Begin: and enter 192.168.200.249 in the field next to Client Address Range End:’. When done, click Accept in the upper-right corner to save and activate the change.
4. Navigate to the Clients >Settings > Client Routes page. Add a client route for 192.168.100.0 and 192.168.200.0.
5. Navigate to the Network > DNS page and enter your internal network’s DNS addresses, internal domain name, and WINS server addresses. These are critical for NetExtender to function correctly. When done, click Accept in the upper-right corner to save and activate the change.
6. Navigate to the System > Restart page and click Restart…
7. Install the SMA appliance’s X0 interface on the unused DMZ network of the PIX. Do not hook any of the appliance’s other interfaces up.
8. Connect to the PIX’s management CLI by way of console port, telnet, or SSH and enter configure mode.
9. Issue the command ‘clear http’ to shut off the PIX’s HTTP/S management interface.
10. Issue the command ‘interface ethernet2 auto’ (or whatever interface you are using)
11. Issue the command ‘nameif ethernet2 dmz security4’ (or whatever interface you are using)
12. Issue the command ‘ip address dmz 192.168.200.2 255.255.255.0’
13. Issue the command ‘nat (dmz) 1 192.168.200.0 255.255.255.0 0 0’
14. Issue the command ‘access-list sslvpn permit tcp any host x.x.x.x eq www’ (replace x.x.x.x with the WAN IP address of your PIX)
15. Issue the command ‘access-list sslvpn permit tcp any host x.x.x.x eq https’ (replace x.x.x.x with the WAN IP address of your PIX)
16. Issue the command ‘access-list dmz-to-inside permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0’
17. Issue the command ‘access-list dmz-to-inside permit ip host 192.168.200.1 any’
18. Issue the command ‘static (dmz,outside) tcp x.x.x.x www 192.168.200.1 www netmask 255.255.255.255 0 0’ (replace x.x.x.x with the WAN IP address of your PIX)
19. Issue the command ‘static (dmz,outside) tcp x.x.x.x https 192.168.200.1 https netmask 255.255.255.255 0 0’ (replace x.x.x.x with the WAN IP address of your PIX)
20. Issue the command ‘static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0 0 0’
21. Issue the command ‘access-group sslvpn in interface outside’
22. Issue the command ‘access-group dmz-to-inside in interface dmz’
23. Exit config mode and issue the command ‘wr mem’ to save and activate the changes.
24. From an external system, attempt to connect to the SMA appliance using both HTTP and HTTPS. If you cannot access the SMA appliance, check all previous steps and test again.

Final Config Sample – Relevant Programming in Bold:

PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto

nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security4

enable password SqjOo0II7Q4T90ap encrypted passwd SqjOo0II7Q4T90ap encrypted hostname tenaya

domain-name vpntestlab.com clock timezone PDT -8

clock summer-time PDT  recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21

fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80

fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69

names

access-list sslvpn permit tcp any host 64.41.140.167 eq www access-list sslvpn permit tcp any host 64.41.140.167 eq https

access-list dmz-to-inside permit ip 192.168.200.0 255.255.255.0 192.168.100.0

255.255.255.0

access-list dmz-to-inside permit ip host 192.168.200.1 any pager lines 24

logging on logging timestamp

logging buffered warnings mtu outside 1500

mtu inside 1500

mtu dmz 1500

ip address outside 64.41.140.167 255.255.255.224

ip address inside 192.168.100.1 255.255.255.0

ip address dmz 192.168.200.2 255.255.255.0 ip audit info action alarm

ip audit attack action alarm pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 192.168.100.0 255.255.255.0 0 0

nat (dmz) 1 192.168.200.0 255.255.255.0 0 0

static (dmz,outside) tcp 64.41.140.167 www 192.168.200.1 www netmask 255.255.255.255

0 0

static (dmz,outside) tcp 64.41.140.167 https 192.168.200.1 https netmask 255.255.255.255 0 0

static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0 0 0 access-group sslvpn in interface outside

access-group dmz-to-inside in interface dmz route outside 0.0.0.0 0.0.0.0 64.41.140.166 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

ntp server 192.43.244.18 source outside prefer floodguard enable

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 15

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 15

console timeout 20

dhcpd address 192.168.100.101-192.168.100.199 inside dhcpd dns 192.168.100.10

dhcpd lease 600

dhcpd ping_timeout 750 dhcpd domain vpntestlab.com dhcpd enable inside terminal width 80

banner motd Restricted Access. Please log in to continue. Cryptochecksum:81330e717bdbfdc16a140402cb503a77

: end