Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Unable to Access Internet with PIX506E

Posted on 2005-03-19
11
Medium Priority
?
267 Views
Last Modified: 2010-05-18
Hi,

Can anyone see why this configuration with not let local PC's on network 10.50.0.0 255.255.0.0 access the internet (http browsing) ?

Network - 10.50.0.0 255.255.0.0
PIX Int - 10.50.254.50
Pix Ext - 217.45.237.132
Ext Router - 217.45.237.134

My PC's pick up a dhcp address from the PIX, gateway is the pix (10.50.254.50).  I've taken the config from a number of PIX506 devices on my company VPN, some of these have split tunnel to allow brealout to the net.  Really puzzled to why this does not work.

Thanks in advance.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname j4cpix
domain-name j4c.co.uk
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 217.45.237.132 255.255.255.248
ip address inside 10.50.254.50 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 217.45.237.133
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 217.45.237.134 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.50.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.50.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.50.11.1-10.50.11.254 inside
dhcpd dns 217.31.128.9 212.23.8.1
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain 212.23.8.6
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
0
Comment
Question by:wayneinuk
  • 5
  • 3
  • 3
11 Comments
 

Author Comment

by:wayneinuk
ID: 13582019
One thing I forgot to mention, I can ping an external host from the outside interface of the PIX.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 13582526
Can you post result of "show interface"
0
 
LVL 7

Expert Comment

by:minmei
ID: 13582702
Could be the

dhcpd auto_config outside

command. This is used for PIXes that are DHCP clients on the outside, and thus have no fixed dns to choose, since it can be changed whenever the ISP desires. This command sets the internal DNS to the same value you would get with DHCP on the outside.

But you aren't using DHCP on the outside.

What do the workstations get for dns?  The

dhcpd dns 217.31.128.9 212.23.8.1

ones?

0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 

Author Comment

by:wayneinuk
ID: 13583034
Hi lrmoore,

Thanks for the response.  Details of "sh int" as below.

sh int

interface ethernet0 "outside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.6585.82ad
  IP address 217.45.237.132, subnet mask 255.255.255.248
  MTU 1500 bytes, BW 100000 Kbit full duplex
      1 packets input, 60 bytes, 0 no buffer
      Received 0 broadcasts, 0 runts, 0 giants
      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
      25 packets output, 1865 bytes, 0 underruns
      0 output errors, 0 collisions, 0 interface resets
      0 babbles, 0 late collisions, 0 deferred
      0 lost carrier, 0 no carrier
      input queue (curr/max blocks): hardware (128/128) software (0/1)
      output queue (curr/max blocks): hardware (0/2) software (0/1)
interface ethernet1 "inside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.6585.82ae
  IP address 10.50.254.50, subnet mask 255.255.0.0
  MTU 1500 bytes, BW 100000 Kbit full duplex
      96 packets input, 13622 bytes, 0 no buffer
      Received 71 broadcasts, 0 runts, 0 giants
      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
      8 packets output, 1068 bytes, 0 underruns
      0 output errors, 0 collisions, 0 interface resets
      0 babbles, 0 late collisions, 0 deferred
      0 lost carrier, 0 no carrier
      input queue (curr/max blocks): hardware (128/128) software (0/1)
      output queue (curr/max blocks): hardware (0/1) software (0/1)


j4cpix#  

Please be aware that I've just booted the PIX.

Thnaks
0
 

Author Comment

by:wayneinuk
ID: 13583038
Hi minmei,

Workstations get the 10.50.x.x addresses with the correct gateway of 10.50.254.50

Thanks
0
 

Author Comment

by:wayneinuk
ID: 13583050
Hi minmei,

Read your query incorrectly, the workstations are not getting anything for dns, however even if I try to get to a known IP address such as 193.133.12.195 if get nothing.

Regards
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 13583126
>the workstations are not getting anything for dns
Hmmmm...
Agree w/minmei, remove this line:

    no dhcpd auto_config outside

Remember that you can't use ping as a test for getting out. Try http to a specific IP address. i.e. click on this link (EE website) http://64.156.132.140
If that works, then we know that it's a DNS problem..

0
 
LVL 7

Accepted Solution

by:
minmei earned 1000 total points
ID: 13583260
If PIX can ping an external host (not just same subnet) like lrmoore's 64.156.132.140, then the ISP is routing the subnet correctly.

If PC cannot ping to external address, then either:

1) not getting to correct default gateway. You said they get the dg or the PIX internal address.
2) not allowed outbound (some funky acl on the PIX). Didn't see any in config.
3) not translating correctly. Do a

sh xlate

and let us see what's translated. Or take the second global command out:

global (outside) 1 217.45.237.133

and leave the interface, because that seems to work (above, PIX can ping outside.)
0
 

Author Comment

by:wayneinuk
ID: 13585130
Hi lrmoore / minmei,

Took out the dhcpd auto_config outside - this made no difference.  Tried http to 64.156.132.140 with no luck, same as my test to 193.133.12.195

Tried pinging 64.156.132.140 from the PIX and got replies.

PC's are getting a dg of 10.50.254.50 which is the LAN side of the PIX - there is no internal router on this network, whereas normally I run an internal router with GRE to provide ISDN backup.  This is my first attempt without that.

The results of sh xlate are :-

sh xlate
8 in use, 8 most used
PAT Global 217.45.237.133(1026) Local 10.50.1.1(6152)
PAT Global 217.45.237.133(1026) Local 10.50.2.1(1460)
PAT Global 217.45.237.133(1027) Local 10.50.1.1(4124)
PAT Global 217.45.237.133(1027) Local 10.50.2.1(1461)
PAT Global 217.45.237.133(1028) Local 10.50.1.1(6180)
PAT Global 217.45.237.133(1024) Local 10.50.1.1(1208)
PAT Global 217.45.237.133(1025) Local 10.50.1.1(6160)
PAT Global 217.45.237.133(1025) Local 10.50.2.1(1459)

j4cpix#

Took the line 'global (outside) 1 217.45.237.133' out and everything works OK

Any ideas why ?  
Also is it secure ?

Thankyou both for your help (how do I sort the points?)
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 1000 total points
ID: 13585624
>Took the line 'global (outside) 1 217.45.237.133' out and everything works OK

Not sure if your ISP assigned that IP address to you. Knowing that the "interface" IP works fine for you, but a second IP does not, then I can think of only one of two things:
1) ISP has that IP assigned to someone else
2) you have "sysopt noproxyarp outside" enabled, but I don't see that in your config that you posted

You are fully secure

You can split points if you'd like..
0
 
LVL 7

Expert Comment

by:minmei
ID: 13586948
Points are your call, whim, desire. Anything is ok w/me.
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
Suggested Courses
Course of the Month13 days, 22 hours left to enroll

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question