Unable to Access Internet with PIX506E
Hi,
Can anyone see why this configuration with not let local PC's on network 10.50.0.0 255.255.0.0 access the internet (http browsing) ?
Network - 10.50.0.0 255.255.0.0
PIX Int - 10.50.254.50
Pix Ext - 217.45.237.132
Ext Router - 217.45.237.134
My PC's pick up a dhcp address from the PIX, gateway is the pix (10.50.254.50). I've taken the config from a number of PIX506 devices on my company VPN, some of these have split tunnel to allow brealout to the net. Really puzzled to why this does not work.
Thanks in advance.
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname j4cpix
domain-name j4c.co.uk
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 217.45.237.132 255.255.255.248
ip address inside 10.50.254.50 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 217.45.237.133
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 217.45.237.134 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.50.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.50.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.50.11.1-10.50.11.254 inside
dhcpd dns 217.31.128.9 212.23.8.1
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain 212.23.8.6
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Can anyone see why this configuration with not let local PC's on network 10.50.0.0 255.255.0.0 access the internet (http browsing) ?
Network - 10.50.0.0 255.255.0.0
PIX Int - 10.50.254.50
Pix Ext - 217.45.237.132
Ext Router - 217.45.237.134
My PC's pick up a dhcp address from the PIX, gateway is the pix (10.50.254.50). I've taken the config from a number of PIX506 devices on my company VPN, some of these have split tunnel to allow brealout to the net. Really puzzled to why this does not work.
Thanks in advance.
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname j4cpix
domain-name j4c.co.uk
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 217.45.237.132 255.255.255.248
ip address inside 10.50.254.50 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 217.45.237.133
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 217.45.237.134 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.50.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.50.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.50.11.1-10.50.11.254 inside
dhcpd dns 217.31.128.9 212.23.8.1
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain 212.23.8.6
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Can you post result of "show interface"
Could be the
dhcpd auto_config outside
command. This is used for PIXes that are DHCP clients on the outside, and thus have no fixed dns to choose, since it can be changed whenever the ISP desires. This command sets the internal DNS to the same value you would get with DHCP on the outside.
But you aren't using DHCP on the outside.
What do the workstations get for dns? The
dhcpd dns 217.31.128.9 212.23.8.1
ones?
dhcpd auto_config outside
command. This is used for PIXes that are DHCP clients on the outside, and thus have no fixed dns to choose, since it can be changed whenever the ISP desires. This command sets the internal DNS to the same value you would get with DHCP on the outside.
But you aren't using DHCP on the outside.
What do the workstations get for dns? The
dhcpd dns 217.31.128.9 212.23.8.1
ones?
ASKER
Hi lrmoore,
Thanks for the response. Details of "sh int" as below.
sh int
interface ethernet0 "outside" is up, line protocol is up
Hardware is i82559 ethernet, address is 000d.6585.82ad
IP address 217.45.237.132, subnet mask 255.255.255.248
MTU 1500 bytes, BW 100000 Kbit full duplex
1 packets input, 60 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
25 packets output, 1865 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/1)
output queue (curr/max blocks): hardware (0/2) software (0/1)
interface ethernet1 "inside" is up, line protocol is up
Hardware is i82559 ethernet, address is 000d.6585.82ae
IP address 10.50.254.50, subnet mask 255.255.0.0
MTU 1500 bytes, BW 100000 Kbit full duplex
96 packets input, 13622 bytes, 0 no buffer
Received 71 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
8 packets output, 1068 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/1)
output queue (curr/max blocks): hardware (0/1) software (0/1)
j4cpix#
Please be aware that I've just booted the PIX.
Thnaks
Thanks for the response. Details of "sh int" as below.
sh int
interface ethernet0 "outside" is up, line protocol is up
Hardware is i82559 ethernet, address is 000d.6585.82ad
IP address 217.45.237.132, subnet mask 255.255.255.248
MTU 1500 bytes, BW 100000 Kbit full duplex
1 packets input, 60 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
25 packets output, 1865 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/1)
output queue (curr/max blocks): hardware (0/2) software (0/1)
interface ethernet1 "inside" is up, line protocol is up
Hardware is i82559 ethernet, address is 000d.6585.82ae
IP address 10.50.254.50, subnet mask 255.255.0.0
MTU 1500 bytes, BW 100000 Kbit full duplex
96 packets input, 13622 bytes, 0 no buffer
Received 71 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
8 packets output, 1068 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/1)
output queue (curr/max blocks): hardware (0/1) software (0/1)
j4cpix#
Please be aware that I've just booted the PIX.
Thnaks
ASKER
Hi minmei,
Workstations get the 10.50.x.x addresses with the correct gateway of 10.50.254.50
Thanks
Workstations get the 10.50.x.x addresses with the correct gateway of 10.50.254.50
Thanks
ASKER
Hi minmei,
Read your query incorrectly, the workstations are not getting anything for dns, however even if I try to get to a known IP address such as 193.133.12.195 if get nothing.
Regards
Read your query incorrectly, the workstations are not getting anything for dns, however even if I try to get to a known IP address such as 193.133.12.195 if get nothing.
Regards
>the workstations are not getting anything for dns
Hmmmm...
Agree w/minmei, remove this line:
no dhcpd auto_config outside
Remember that you can't use ping as a test for getting out. Try http to a specific IP address. i.e. click on this link (EE website) http://64.156.132.140
If that works, then we know that it's a DNS problem..
Hmmmm...
Agree w/minmei, remove this line:
no dhcpd auto_config outside
Remember that you can't use ping as a test for getting out. Try http to a specific IP address. i.e. click on this link (EE website) http://64.156.132.140
If that works, then we know that it's a DNS problem..
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hi lrmoore / minmei,
Took out the dhcpd auto_config outside - this made no difference. Tried http to 64.156.132.140 with no luck, same as my test to 193.133.12.195
Tried pinging 64.156.132.140 from the PIX and got replies.
PC's are getting a dg of 10.50.254.50 which is the LAN side of the PIX - there is no internal router on this network, whereas normally I run an internal router with GRE to provide ISDN backup. This is my first attempt without that.
The results of sh xlate are :-
sh xlate
8 in use, 8 most used
PAT Global 217.45.237.133(1026) Local 10.50.1.1(6152)
PAT Global 217.45.237.133(1026) Local 10.50.2.1(1460)
PAT Global 217.45.237.133(1027) Local 10.50.1.1(4124)
PAT Global 217.45.237.133(1027) Local 10.50.2.1(1461)
PAT Global 217.45.237.133(1028) Local 10.50.1.1(6180)
PAT Global 217.45.237.133(1024) Local 10.50.1.1(1208)
PAT Global 217.45.237.133(1025) Local 10.50.1.1(6160)
PAT Global 217.45.237.133(1025) Local 10.50.2.1(1459)
j4cpix#
Took the line 'global (outside) 1 217.45.237.133' out and everything works OK
Any ideas why ?
Also is it secure ?
Thankyou both for your help (how do I sort the points?)
Took out the dhcpd auto_config outside - this made no difference. Tried http to 64.156.132.140 with no luck, same as my test to 193.133.12.195
Tried pinging 64.156.132.140 from the PIX and got replies.
PC's are getting a dg of 10.50.254.50 which is the LAN side of the PIX - there is no internal router on this network, whereas normally I run an internal router with GRE to provide ISDN backup. This is my first attempt without that.
The results of sh xlate are :-
sh xlate
8 in use, 8 most used
PAT Global 217.45.237.133(1026) Local 10.50.1.1(6152)
PAT Global 217.45.237.133(1026) Local 10.50.2.1(1460)
PAT Global 217.45.237.133(1027) Local 10.50.1.1(4124)
PAT Global 217.45.237.133(1027) Local 10.50.2.1(1461)
PAT Global 217.45.237.133(1028) Local 10.50.1.1(6180)
PAT Global 217.45.237.133(1024) Local 10.50.1.1(1208)
PAT Global 217.45.237.133(1025) Local 10.50.1.1(6160)
PAT Global 217.45.237.133(1025) Local 10.50.2.1(1459)
j4cpix#
Took the line 'global (outside) 1 217.45.237.133' out and everything works OK
Any ideas why ?
Also is it secure ?
Thankyou both for your help (how do I sort the points?)
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Points are your call, whim, desire. Anything is ok w/me.
ASKER