Solved

Can't route out PIX

Posted on 2006-06-25
7
503 Views
Last Modified: 2013-11-16
  I have a PIX 501 hooked up to a Motorola Surfboard Cable modem for Comcast.
I cannot get traffic to route from the inside to the outside through the Pix. While consoled into the Pix,  I can ping out the outside interface to several internet IPs. But I cannot get any traffic to go from the internal network to the internet. I have erased the config several times and configured it by hand and via PDM. Whay am I missing here.

PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXXXXXX
passwd XXXXXXXXXXXXXXX
hostname CiscoPIX
domain-name mydomain.net
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_access_in permit ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.20.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.20.2 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.20.2 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community XXXXXXXXX
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 192.168.20.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
: end
CiscoPIX#
0
Comment
Question by:johnelayn
7 Comments
 
LVL 2

Assisted Solution

by:martyboy
martyboy earned 50 total points
ID: 16982352
You dont need your accesslist, you can remove that statement.

What does sh interface say?
Have you checked the log?

0
 
LVL 6

Expert Comment

by:foobar_666uk
ID: 16982763
I take it you are statically assigning inside host addresses?

Is this a DNS issue you are seeing? Have you specified a DNS server? Can you ping web servers?

If you want the CISCO PIX to be a DHCP Server and assign DNS, uses these command line examples;

dhcpd address 10.0.1.101-10.0.1.110 inside         <--- Sets the PIX to be a DHCP using the address range 10.0.1.101 to 10.0.1.110

dhcpd dns 209.165.201.2 209.165.202.129            <---- Sets 2x DNS servers as specified.



0
 
LVL 2

Expert Comment

by:martyboy
ID: 16982990
and btw you cant by deafult use ping from hosts behind your inside interface. You need to configure the pix to allow that.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 100 total points
ID: 16983418
remove the acl from the inside interface. It is not needed:

no access-group inside_access_in in interface inside

Taking martyboy's comment a bit further - allow icmp packets in
 access-list icmp permit icmp any any
 access-group icmp in interface outside

Now you can ping from an inside host, assuming that the inside host has 192.168.20.1 as the default gateway.


0
 
LVL 5

Expert Comment

by:renill
ID: 16990005
icmp permit|deny [host] src_addr [src_mask] [type] int_name


enable icmp in the box...

renill
0
 
LVL 1

Accepted Solution

by:
Jaedub earned 100 total points
ID: 17043539
Your config is fine.  Remove the access-list as mentioned above.  Power cycle your comcast modem and let it come up for 30-60 seconds.  Then power up your pix and wait for 60-90 seconds.  

Open your browser and enter http://72.14.203.99
See what opens up. If that works, your traffic is flowing. If not, let us know.  (we are assuming that your computer has a proper address, subnet mask and gateway of 192.168.20.1)
If you have a properly configured DNS entry, you should be able to open http://www.yahoo.com.

If you want DHCP services, the proper way to configure for your setup is:

dhcpd address 192.168.20.10-192.168.20.25 inside
dhcpd auto_config outside
dhcpd enable inside

Let us know.....

-James
0
 

Author Comment

by:johnelayn
ID: 17046625
Thanks guys, it works fine now.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now