PIX515 - inside cannot browse(access) public Internet

we used to be able to access the public Internet on this one LAN segment that sits behind a Cisco1750 & PIX515. Someone, worked with it a bit and now no access to the Internet. I'll paste the running-config of both in the hopes someone can spot the error and help me get this LAN segment functional again.  thanks.



!==beg 1750 edge router=============
cisco#sh ru
Using 3935 out of 29688 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxx
!
logging buffered 4096 notifications
no logging console
aaa new-model
aaa authentication login default enable
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip source-route
no ip domain-lookup
ip domain-name xxxxxxxxxxxxxxx
ip name-server 206.xx.xx.12
ip name-server 206.xx.xx.12
!
ip audit notify log
ip audit po max-events 100
ip cef
!
interface Serial0
 description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
 no ip address
 ip access-group 178 in
 no ip redirects
 no ip unreachables
 ip nat outside
 encapsulation frame-relay IETF
 fair-queue
 service-module t1 timeslots 1-24
 frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
 description Connection to xxxxxxxxxxxxxxxxxxxxxxxxx
 ip address 64.175.xxx.xxx 255.255.255.0
 ip access-group 179 in
 no ip redirects
 no ip unreachables
 ip directed-broadcast
 no ip proxy-arp
 no cdp enable
 frame-relay interface-dlci 16  
!
interface FastEthernet0
 description xxxxxxxxxxxx LAN
 ip address 66.xxx.xxx.1 255.255.255.224
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 speed auto
 full-duplex
 no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 64.175.xxx.xxx
ip route 192.168.2.0 255.255.255.0 66.xxx.xxx.2
no ip http server
!
logging source-interface Serial0.1
logging xxx.xxx.xxx.xxx
access-list 178 permit ip 192.168.2.0 0.0.0.255 any
!
access-list 179 deny   ip 127.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip any 127.0.0.0 0.255.255.255 log-input
access-list 179 deny   ip 224.0.0.0 31.255.255.255 any log-input
access-list 179 deny   ip 10.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip 172.16.0.0 0.15.255.255 any log-input
access-list 179 deny   icmp any any traceroute log-input
access-list 179 deny   tcp any any eq 1434 log-input
access-list 179 deny   udp any any eq 1434 log-input
access-list 179 deny   53 any any
access-list 179 deny   55 any any
access-list 179 deny   77 any any
access-list 179 deny   pim any any
access-list 179 deny   tcp any any eq 135
access-list 179 deny   udp any any eq 135
access-list 179 deny   udp any any eq 445
access-list 179 deny   tcp any any eq 445
access-list 179 deny   tcp any any eq 88
access-list 179 deny   tcp any any eq pop3
access-list 179 deny   tcp any any eq 143
access-list 179 deny   tcp any any eq 5554
access-list 179 deny   tcp any any eq 9996
access-list 179 permit tcp any any established
access-list 179 permit udp any eq domain any
access-list 179 permit udp any host 66.xxx.xxx.2 eq isakmp
access-list 179 permit esp any host 66.xxx.xxx.2
access-list 179 permit ahp any host 66.xxx.xxx.2
access-list 179 permit udp any host 66.xxx.xxx.2 eq 4500
access-list 179 permit udp any host 66.xxx.xxx.2 eq 22
access-list 179 permit icmp any any echo-reply
access-list 179 permit icmp any any time-exceeded
access-list 179 permit icmp any any administratively-prohibited
access-list 179 deny   ip any any log-input
no cdp run
snmp-server community xxxxxxxxxxxx RO
!
line con 0
 exec-timeout 0 0
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 flowcontrol hardware
line aux 0
line vty 0 4
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
scheduler allocate 4000 1000
end
cisco#
!==end 1750 edge router=============

!==beg pix515=====================
pixfirewall# sh ru
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names        
access-list out_in permit icmp any any echo-reply
access-list out_in permit icmp any any echo
access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
access-list out_in permit icmp any any time-exceeded
access-list in_out permit ip any any
access-list nonat remark bypasses natting for vpn connections
access-list nonat permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
access-list split remark split tunneling for vpn clients
access-list split permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap debugging
logging host inside 192.168.2.5
mtu outside 1500
mtu inside 1500
ip address outside 66.xxx.xxx.2 255.255.255.224
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool CLIENTS 172.16.99.1-172.16.99.254
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp 66.xxx.xxx.2  ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
access-group out_in in interface outside
access-group in_out in interface inside
route outside 0.0.0.0 0.0.0.0 66.xxx.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxxxxxx
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dyna 10 set transform-set myset
crypto map mymap 99 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup xxxxxxxxxxx address-pool CLIENTS
vpngroup xxxxxxxxxxx dns-server 192.168.2.5
vpngroup xxxxxxxxxxx wins-server 192.168.2.5
vpngroup xxxxxxxxxxx split-tunnel split
vpngroup xxxxxxxxxxx idle-time 1800
vpngroup xxxxxxxxxxx password ********
telnet timeout 15
ssh timeout 5
console timeout 0
username xxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
: end
pixfirewall#
!==end pix515==============================


Start Free Trial