Solved

PIX515 - inside cannot browse(access) public Internet

Posted on 2007-04-06
17
572 Views
Last Modified: 2010-04-09
we used to be able to access the public Internet on this one LAN segment that sits behind a Cisco1750 & PIX515. Someone, worked with it a bit and now no access to the Internet. I'll paste the running-config of both in the hopes someone can spot the error and help me get this LAN segment functional again.  thanks.



!==beg 1750 edge router=============
cisco#sh ru
Using 3935 out of 29688 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxx
!
logging buffered 4096 notifications
no logging console
aaa new-model
aaa authentication login default enable
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip source-route
no ip domain-lookup
ip domain-name xxxxxxxxxxxxxxx
ip name-server 206.xx.xx.12
ip name-server 206.xx.xx.12
!
ip audit notify log
ip audit po max-events 100
ip cef
!
interface Serial0
 description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
 no ip address
 ip access-group 178 in
 no ip redirects
 no ip unreachables
 ip nat outside
 encapsulation frame-relay IETF
 fair-queue
 service-module t1 timeslots 1-24
 frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
 description Connection to xxxxxxxxxxxxxxxxxxxxxxxxx
 ip address 64.175.xxx.xxx 255.255.255.0
 ip access-group 179 in
 no ip redirects
 no ip unreachables
 ip directed-broadcast
 no ip proxy-arp
 no cdp enable
 frame-relay interface-dlci 16  
!
interface FastEthernet0
 description xxxxxxxxxxxx LAN
 ip address 66.xxx.xxx.1 255.255.255.224
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 speed auto
 full-duplex
 no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 64.175.xxx.xxx
ip route 192.168.2.0 255.255.255.0 66.xxx.xxx.2
no ip http server
!
logging source-interface Serial0.1
logging xxx.xxx.xxx.xxx
access-list 178 permit ip 192.168.2.0 0.0.0.255 any
!
access-list 179 deny   ip 127.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip any 127.0.0.0 0.255.255.255 log-input
access-list 179 deny   ip 224.0.0.0 31.255.255.255 any log-input
access-list 179 deny   ip 10.0.0.0 0.255.255.255 any log-input
access-list 179 deny   ip 172.16.0.0 0.15.255.255 any log-input
access-list 179 deny   icmp any any traceroute log-input
access-list 179 deny   tcp any any eq 1434 log-input
access-list 179 deny   udp any any eq 1434 log-input
access-list 179 deny   53 any any
access-list 179 deny   55 any any
access-list 179 deny   77 any any
access-list 179 deny   pim any any
access-list 179 deny   tcp any any eq 135
access-list 179 deny   udp any any eq 135
access-list 179 deny   udp any any eq 445
access-list 179 deny   tcp any any eq 445
access-list 179 deny   tcp any any eq 88
access-list 179 deny   tcp any any eq pop3
access-list 179 deny   tcp any any eq 143
access-list 179 deny   tcp any any eq 5554
access-list 179 deny   tcp any any eq 9996
access-list 179 permit tcp any any established
access-list 179 permit udp any eq domain any
access-list 179 permit udp any host 66.xxx.xxx.2 eq isakmp
access-list 179 permit esp any host 66.xxx.xxx.2
access-list 179 permit ahp any host 66.xxx.xxx.2
access-list 179 permit udp any host 66.xxx.xxx.2 eq 4500
access-list 179 permit udp any host 66.xxx.xxx.2 eq 22
access-list 179 permit icmp any any echo-reply
access-list 179 permit icmp any any time-exceeded
access-list 179 permit icmp any any administratively-prohibited
access-list 179 deny   ip any any log-input
no cdp run
snmp-server community xxxxxxxxxxxx RO
!
line con 0
 exec-timeout 0 0
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 flowcontrol hardware
line aux 0
line vty 0 4
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
scheduler allocate 4000 1000
end
cisco#
!==end 1750 edge router=============

!==beg pix515=====================
pixfirewall# sh ru
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names        
access-list out_in permit icmp any any echo-reply
access-list out_in permit icmp any any echo
access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
access-list out_in permit icmp any any time-exceeded
access-list in_out permit ip any any
access-list nonat remark bypasses natting for vpn connections
access-list nonat permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
access-list split remark split tunneling for vpn clients
access-list split permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap debugging
logging host inside 192.168.2.5
mtu outside 1500
mtu inside 1500
ip address outside 66.xxx.xxx.2 255.255.255.224
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool CLIENTS 172.16.99.1-172.16.99.254
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp 66.xxx.xxx.2  ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
access-group out_in in interface outside
access-group in_out in interface inside
route outside 0.0.0.0 0.0.0.0 66.xxx.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxxxxxx
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dyna 10 set transform-set myset
crypto map mymap 99 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup xxxxxxxxxxx address-pool CLIENTS
vpngroup xxxxxxxxxxx dns-server 192.168.2.5
vpngroup xxxxxxxxxxx wins-server 192.168.2.5
vpngroup xxxxxxxxxxx split-tunnel split
vpngroup xxxxxxxxxxx idle-time 1800
vpngroup xxxxxxxxxxx password ********
telnet timeout 15
ssh timeout 5
console timeout 0
username xxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
: end
pixfirewall#
!==end pix515==============================


0
Comment
Question by:demus619
  • 6
  • 5
  • 5
  • +1
17 Comments
 
LVL 4

Expert Comment

by:AndrewCink
ID: 18862757
Can you ping out to the internet from the cisco router? Can you ping out to the internet from the cisco pix? Otherwise my tired brain isn't seeing anything obviously wrong. Can you confirm the IP, mask and gateway of the PC's on the pix subnet? The natting looks a little weird to me, but I'm not sure that anything is wrong with it, I just haven't seen it done that way.
0
 
LVL 29

Accepted Solution

by:
Alan Huseyin Kayahan earned 250 total points
ID: 18863695
PIX
access-list in_out permit ip any any
 is useless. traffic flow from high security interface to low security interface is permit by default. remov this acl

try following command in CLI of PIX, put your ip in xxx
ping outside 66.xxx.xxx.1

is it successfull?
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 250 total points
ID: 18863881
>static (inside,outside) tcp 66.xxx.xxx.2  ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
This static is using the same public IP as your interface - BAD MOVE.
Remove the static and clear xlate and you should be back in business.
Agree with MrHusy that your in_out acl is redundant to the default behavior and is not needed
  no access-group in_out in interface inside

0
 

Author Comment

by:demus619
ID: 18864688
AndrewCink:
the NATing seems different than most lists i've seen on the net too. if you know a better or more standard way let me know.

from the router pinging yahoo: yes
from the pix pinging yahoo: no
=========================================
MrHusy:

i'll remove that redundant acl statement

from the pix pinging it's outside int: yes
from the pix pinging the inside int on routernext hop): yes
from the pix pinging yahoo: no
=========================================

lrmoore:

i'll remove that static statement and see what happens.  i believe that was added so public users could ssh into that box at 192.168.2.22. is an access list better for that than say, a static statement?

more later.... thanks!
0
 
LVL 29

Assisted Solution

by:Alan Huseyin Kayahan
Alan Huseyin Kayahan earned 250 total points
ID: 18864885
          Hi demus
                *I didnt mean to ping PIX's outside interface. I meant pinging the interface of router (which is your default route) 66.xxx.xxx.1
               *By the way, what happens when you run nslookup in a client and check a random www. For example www.google.com. What DNS addresses configured in clients?
             *When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router.
0
 

Author Comment

by:demus619
ID: 18864911
made suggested changes, yet still cannot get out to the Internet... certainly open to more suggestions....
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 250 total points
ID: 18864979
> is an access list better for that than say, a static statement?
You need both, but you just can't use the same IP as both a static 1-1 and dynamic for internal users. You can simply port-forward ssh, and create an acl to allow the traffic, which you have here:
 >access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
But, I suggest using "interface" instead  as here:
 access-list out_in permit tcp any interface outside eq ssh
 static (inside,outside) tcp interface ssh 192.168.2.22 ssh netmask 255.255.255.255
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 18864982
Also use "clear xlate" command
pix#clear xlate
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 18867966
             Still waiting for your feedback about the following
                         *When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router
0
 

Author Comment

by:demus619
ID: 18868324
still cannot go outside, sorry to say. `dig' can't locate dns servers, web browsing via ip address doesn't work. i really don't see anything in syslog where the pix is dropping all these packets, so i'm even more stumped.

are we sure the issue is with the pix and not the edge router?
0
 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 18869084
                 Demus, you cant still go outside when the PC connected to router directly without PIX as i mentioned above?
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 250 total points
ID: 18869269
I see something in your router.....

interface Serial0
 description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
 no ip address
 ip access-group 178 in  <== REMOVE THIS!!!

0
 

Author Comment

by:demus619
ID: 18870469
MrHusy:  i'll put a notebook on a hub in between and test this. it'll have to wait until monday.

lrmoore: I see something in your router.....
             maybe a leftover from a previous config. i'll remove it on monday what i can get back into the building.

more on monday, thanks....

0
 

Author Comment

by:demus619
ID: 18879406
MrHusy:
with a notebook in between the edge router and the pix515, i cannot do dns lookups nor ping any site outside. i can get as far as the inside interface of the edge router.  something amiss on the edge router's ACL.   i'll take a closer look at it.  

more later....
0
 
LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 18890069
            Hi demus
                 Now you have to focus on router. Please do not miss lrmoore's suggestions.

Regards  
0
 

Author Comment

by:demus619
ID: 18899482
up and running, packets flowing. many thanks to lrmoore and mrhusy. if you do not mind, i'll split the points due to both of you helped me out a lot. once again many thanks!
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 18902347
Thanks!
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now