?
Solved

Unable to Access Internet with PIX506E

Posted on 2005-03-19
11
Medium Priority
?
266 Views
Last Modified: 2010-05-18
Hi,

Can anyone see why this configuration with not let local PC's on network 10.50.0.0 255.255.0.0 access the internet (http browsing) ?

Network - 10.50.0.0 255.255.0.0
PIX Int - 10.50.254.50
Pix Ext - 217.45.237.132
Ext Router - 217.45.237.134

My PC's pick up a dhcp address from the PIX, gateway is the pix (10.50.254.50).  I've taken the config from a number of PIX506 devices on my company VPN, some of these have split tunnel to allow brealout to the net.  Really puzzled to why this does not work.

Thanks in advance.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname j4cpix
domain-name j4c.co.uk
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 217.45.237.132 255.255.255.248
ip address inside 10.50.254.50 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 217.45.237.133
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 217.45.237.134 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.50.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.50.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.50.11.1-10.50.11.254 inside
dhcpd dns 217.31.128.9 212.23.8.1
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain 212.23.8.6
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
0
Comment
Question by:wayneinuk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 3
11 Comments
 

Author Comment

by:wayneinuk
ID: 13582019
One thing I forgot to mention, I can ping an external host from the outside interface of the PIX.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 13582526
Can you post result of "show interface"
0
 
LVL 7

Expert Comment

by:minmei
ID: 13582702
Could be the

dhcpd auto_config outside

command. This is used for PIXes that are DHCP clients on the outside, and thus have no fixed dns to choose, since it can be changed whenever the ISP desires. This command sets the internal DNS to the same value you would get with DHCP on the outside.

But you aren't using DHCP on the outside.

What do the workstations get for dns?  The

dhcpd dns 217.31.128.9 212.23.8.1

ones?

0
Bringing Advanced Authentication to the SMB Market

WatchGuard announces the acquisition of advanced authentication provider, Datablink, with one mission – to bring secure authentication to SMB, mid-market, and distributed enterprises with a cloud-based solution, ideal for resale via their established channel & MSSP community.

 

Author Comment

by:wayneinuk
ID: 13583034
Hi lrmoore,

Thanks for the response.  Details of "sh int" as below.

sh int

interface ethernet0 "outside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.6585.82ad
  IP address 217.45.237.132, subnet mask 255.255.255.248
  MTU 1500 bytes, BW 100000 Kbit full duplex
      1 packets input, 60 bytes, 0 no buffer
      Received 0 broadcasts, 0 runts, 0 giants
      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
      25 packets output, 1865 bytes, 0 underruns
      0 output errors, 0 collisions, 0 interface resets
      0 babbles, 0 late collisions, 0 deferred
      0 lost carrier, 0 no carrier
      input queue (curr/max blocks): hardware (128/128) software (0/1)
      output queue (curr/max blocks): hardware (0/2) software (0/1)
interface ethernet1 "inside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.6585.82ae
  IP address 10.50.254.50, subnet mask 255.255.0.0
  MTU 1500 bytes, BW 100000 Kbit full duplex
      96 packets input, 13622 bytes, 0 no buffer
      Received 71 broadcasts, 0 runts, 0 giants
      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
      8 packets output, 1068 bytes, 0 underruns
      0 output errors, 0 collisions, 0 interface resets
      0 babbles, 0 late collisions, 0 deferred
      0 lost carrier, 0 no carrier
      input queue (curr/max blocks): hardware (128/128) software (0/1)
      output queue (curr/max blocks): hardware (0/1) software (0/1)


j4cpix#  

Please be aware that I've just booted the PIX.

Thnaks
0
 

Author Comment

by:wayneinuk
ID: 13583038
Hi minmei,

Workstations get the 10.50.x.x addresses with the correct gateway of 10.50.254.50

Thanks
0
 

Author Comment

by:wayneinuk
ID: 13583050
Hi minmei,

Read your query incorrectly, the workstations are not getting anything for dns, however even if I try to get to a known IP address such as 193.133.12.195 if get nothing.

Regards
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 13583126
>the workstations are not getting anything for dns
Hmmmm...
Agree w/minmei, remove this line:

    no dhcpd auto_config outside

Remember that you can't use ping as a test for getting out. Try http to a specific IP address. i.e. click on this link (EE website) http://64.156.132.140
If that works, then we know that it's a DNS problem..

0
 
LVL 7

Accepted Solution

by:
minmei earned 1000 total points
ID: 13583260
If PIX can ping an external host (not just same subnet) like lrmoore's 64.156.132.140, then the ISP is routing the subnet correctly.

If PC cannot ping to external address, then either:

1) not getting to correct default gateway. You said they get the dg or the PIX internal address.
2) not allowed outbound (some funky acl on the PIX). Didn't see any in config.
3) not translating correctly. Do a

sh xlate

and let us see what's translated. Or take the second global command out:

global (outside) 1 217.45.237.133

and leave the interface, because that seems to work (above, PIX can ping outside.)
0
 

Author Comment

by:wayneinuk
ID: 13585130
Hi lrmoore / minmei,

Took out the dhcpd auto_config outside - this made no difference.  Tried http to 64.156.132.140 with no luck, same as my test to 193.133.12.195

Tried pinging 64.156.132.140 from the PIX and got replies.

PC's are getting a dg of 10.50.254.50 which is the LAN side of the PIX - there is no internal router on this network, whereas normally I run an internal router with GRE to provide ISDN backup.  This is my first attempt without that.

The results of sh xlate are :-

sh xlate
8 in use, 8 most used
PAT Global 217.45.237.133(1026) Local 10.50.1.1(6152)
PAT Global 217.45.237.133(1026) Local 10.50.2.1(1460)
PAT Global 217.45.237.133(1027) Local 10.50.1.1(4124)
PAT Global 217.45.237.133(1027) Local 10.50.2.1(1461)
PAT Global 217.45.237.133(1028) Local 10.50.1.1(6180)
PAT Global 217.45.237.133(1024) Local 10.50.1.1(1208)
PAT Global 217.45.237.133(1025) Local 10.50.1.1(6160)
PAT Global 217.45.237.133(1025) Local 10.50.2.1(1459)

j4cpix#

Took the line 'global (outside) 1 217.45.237.133' out and everything works OK

Any ideas why ?  
Also is it secure ?

Thankyou both for your help (how do I sort the points?)
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 1000 total points
ID: 13585624
>Took the line 'global (outside) 1 217.45.237.133' out and everything works OK

Not sure if your ISP assigned that IP address to you. Knowing that the "interface" IP works fine for you, but a second IP does not, then I can think of only one of two things:
1) ISP has that IP assigned to someone else
2) you have "sysopt noproxyarp outside" enabled, but I don't see that in your config that you posted

You are fully secure

You can split points if you'd like..
0
 
LVL 7

Expert Comment

by:minmei
ID: 13586948
Points are your call, whim, desire. Anything is ok w/me.
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question