PIX515 - inside cannot browse(access) public Internet

we used to be able to access the public Internet on this one LAN segment that sits behind a Cisco1750 & PIX515. Someone, worked with it a bit and now no access to the Internet. I'll paste the running-config of both in the hopes someone can spot the error and help me get this LAN segment functional again.  thanks.



!==beg 1750 edge router=============
cisco#sh ru
Using 3935 out of 29688 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxx
!
logging buffered 4096 notifications
no logging console
aaa new-model
aaa authentication login default enable
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip source-route
no ip domain-lookup
ip domain-name xxxxxxxxxxxxxxx
ip name-server 206.xx.xx.12
ip name-server 206.xx.xx.12
!
ip audit notify log
ip audit po max-events 100
ip cef
!
interface Serial0
 description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
 no ip address
 ip access-group 178 in
 no ip redirects
 no ip unreachables
 ip nat outside
 encapsulation frame-relay IETF
 fair-queue
 service-module t1 timeslots 1-24
 frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
 description Connection to xxxxxxxxxxxxxxxxxxxxxxxxx
 ip address 64.175.xxx.xxx 255.255.255.0
 ip access-group 179 in
 no ip redirects
 no ip unreachables
 ip directed-broadcast
 no ip proxy-arp
 no cdp enable
 frame-relay interface-dlci 16  
!
interface FastEthernet0
 description xxxxxxxxxxxx LAN
 ip address 66.xxx.xxx.1 255.255.255.224
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 speed auto
 full-duplex
 no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 64.175.xxx.xxx
ip route 192.168.2.0 255.255.255.0 66.xxx.xxx.2
no ip http server
!
logging source-interface Serial0.1
logging xxx.xxx.xxx.xxx
access-list 178 permit ip 192.168.2.0 0.0.0.255 any
!
access-list 179 deny   ip 127.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip any 127.0.0.0 0.255.255.255 log-input
access-list 179 deny   ip 224.0.0.0 31.255.255.255 any log-input
access-list 179 deny   ip 10.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip 172.16.0.0 0.15.255.255 any log-input
access-list 179 deny   icmp any any traceroute log-input
access-list 179 deny   tcp any any eq 1434 log-input
access-list 179 deny   udp any any eq 1434 log-input
access-list 179 deny   53 any any
access-list 179 deny   55 any any
access-list 179 deny   77 any any
access-list 179 deny   pim any any
access-list 179 deny   tcp any any eq 135
access-list 179 deny   udp any any eq 135
access-list 179 deny   udp any any eq 445
access-list 179 deny   tcp any any eq 445
access-list 179 deny   tcp any any eq 88
access-list 179 deny   tcp any any eq pop3
access-list 179 deny   tcp any any eq 143
access-list 179 deny   tcp any any eq 5554
access-list 179 deny   tcp any any eq 9996
access-list 179 permit tcp any any established
access-list 179 permit udp any eq domain any
access-list 179 permit udp any host 66.xxx.xxx.2 eq isakmp
access-list 179 permit esp any host 66.xxx.xxx.2
access-list 179 permit ahp any host 66.xxx.xxx.2
access-list 179 permit udp any host 66.xxx.xxx.2 eq 4500
access-list 179 permit udp any host 66.xxx.xxx.2 eq 22
access-list 179 permit icmp any any echo-reply
access-list 179 permit icmp any any time-exceeded
access-list 179 permit icmp any any administratively-prohibited
access-list 179 deny   ip any any log-input
no cdp run
snmp-server community xxxxxxxxxxxx RO
!
line con 0
 exec-timeout 0 0
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 flowcontrol hardware
line aux 0
line vty 0 4
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
scheduler allocate 4000 1000
end
cisco#
!==end 1750 edge router=============

!==beg pix515=====================
pixfirewall# sh ru
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names        
access-list out_in permit icmp any any echo-reply
access-list out_in permit icmp any any echo
access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
access-list out_in permit icmp any any time-exceeded
access-list in_out permit ip any any
access-list nonat remark bypasses natting for vpn connections
access-list nonat permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
access-list split remark split tunneling for vpn clients
access-list split permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap debugging
logging host inside 192.168.2.5
mtu outside 1500
mtu inside 1500
ip address outside 66.xxx.xxx.2 255.255.255.224
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool CLIENTS 172.16.99.1-172.16.99.254
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp 66.xxx.xxx.2  ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
access-group out_in in interface outside
access-group in_out in interface inside
route outside 0.0.0.0 0.0.0.0 66.xxx.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxxxxxx
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dyna 10 set transform-set myset
crypto map mymap 99 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup xxxxxxxxxxx address-pool CLIENTS
vpngroup xxxxxxxxxxx dns-server 192.168.2.5
vpngroup xxxxxxxxxxx wins-server 192.168.2.5
vpngroup xxxxxxxxxxx split-tunnel split
vpngroup xxxxxxxxxxx idle-time 1800
vpngroup xxxxxxxxxxx password ********
telnet timeout 15
ssh timeout 5
console timeout 0
username xxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
: end
pixfirewall#
!==end pix515==============================


demus619Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AndrewCinkCommented:
Can you ping out to the internet from the cisco router? Can you ping out to the internet from the cisco pix? Otherwise my tired brain isn't seeing anything obviously wrong. Can you confirm the IP, mask and gateway of the PC's on the pix subnet? The natting looks a little weird to me, but I'm not sure that anything is wrong with it, I just haven't seen it done that way.
0
Alan Huseyin KayahanCommented:
PIX
access-list in_out permit ip any any
 is useless. traffic flow from high security interface to low security interface is permit by default. remov this acl

try following command in CLI of PIX, put your ip in xxx
ping outside 66.xxx.xxx.1

is it successfull?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
lrmooreCommented:
>static (inside,outside) tcp 66.xxx.xxx.2  ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
This static is using the same public IP as your interface - BAD MOVE.
Remove the static and clear xlate and you should be back in business.
Agree with MrHusy that your in_out acl is redundant to the default behavior and is not needed
  no access-group in_out in interface inside

0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

demus619Author Commented:
AndrewCink:
the NATing seems different than most lists i've seen on the net too. if you know a better or more standard way let me know.

from the router pinging yahoo: yes
from the pix pinging yahoo: no
=========================================
MrHusy:

i'll remove that redundant acl statement

from the pix pinging it's outside int: yes
from the pix pinging the inside int on routernext hop): yes
from the pix pinging yahoo: no
=========================================

lrmoore:

i'll remove that static statement and see what happens.  i believe that was added so public users could ssh into that box at 192.168.2.22. is an access list better for that than say, a static statement?

more later.... thanks!
0
Alan Huseyin KayahanCommented:
          Hi demus
                *I didnt mean to ping PIX's outside interface. I meant pinging the interface of router (which is your default route) 66.xxx.xxx.1
               *By the way, what happens when you run nslookup in a client and check a random www. For example www.google.com. What DNS addresses configured in clients?
             *When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router.
0
demus619Author Commented:
made suggested changes, yet still cannot get out to the Internet... certainly open to more suggestions....
0
lrmooreCommented:
> is an access list better for that than say, a static statement?
You need both, but you just can't use the same IP as both a static 1-1 and dynamic for internal users. You can simply port-forward ssh, and create an acl to allow the traffic, which you have here:
 >access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
But, I suggest using "interface" instead  as here:
 access-list out_in permit tcp any interface outside eq ssh
 static (inside,outside) tcp interface ssh 192.168.2.22 ssh netmask 255.255.255.255
0
lrmooreCommented:
Also use "clear xlate" command
pix#clear xlate
0
Alan Huseyin KayahanCommented:
             Still waiting for your feedback about the following
                         *When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router
0
demus619Author Commented:
still cannot go outside, sorry to say. `dig' can't locate dns servers, web browsing via ip address doesn't work. i really don't see anything in syslog where the pix is dropping all these packets, so i'm even more stumped.

are we sure the issue is with the pix and not the edge router?
0
Alan Huseyin KayahanCommented:
                 Demus, you cant still go outside when the PC connected to router directly without PIX as i mentioned above?
0
lrmooreCommented:
I see something in your router.....

interface Serial0
 description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
 no ip address
 ip access-group 178 in  <== REMOVE THIS!!!

0
demus619Author Commented:
MrHusy:  i'll put a notebook on a hub in between and test this. it'll have to wait until monday.

lrmoore: I see something in your router.....
             maybe a leftover from a previous config. i'll remove it on monday what i can get back into the building.

more on monday, thanks....

0
demus619Author Commented:
MrHusy:
with a notebook in between the edge router and the pix515, i cannot do dns lookups nor ping any site outside. i can get as far as the inside interface of the edge router.  something amiss on the edge router's ACL.   i'll take a closer look at it.  

more later....
0
Alan Huseyin KayahanCommented:
            Hi demus
                 Now you have to focus on router. Please do not miss lrmoore's suggestions.

Regards  
0
demus619Author Commented:
up and running, packets flowing. many thanks to lrmoore and mrhusy. if you do not mind, i'll split the points due to both of you helped me out a lot. once again many thanks!
0
lrmooreCommented:
Thanks!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.