demus619
asked on
PIX515 - inside cannot browse(access) public Internet
we used to be able to access the public Internet on this one LAN segment that sits behind a Cisco1750 & PIX515. Someone, worked with it a bit and now no access to the Internet. I'll paste the running-config of both in the hopes someone can spot the error and help me get this LAN segment functional again. thanks.
!==beg 1750 edge router=============
cisco#sh ru
Using 3935 out of 29688 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxx
!
logging buffered 4096 notifications
no logging console
aaa new-model
aaa authentication login default enable
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip source-route
no ip domain-lookup
ip domain-name xxxxxxxxxxxxxxx
ip name-server 206.xx.xx.12
ip name-server 206.xx.xx.12
!
ip audit notify log
ip audit po max-events 100
ip cef
!
interface Serial0
description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
no ip address
ip access-group 178 in
no ip redirects
no ip unreachables
ip nat outside
encapsulation frame-relay IETF
fair-queue
service-module t1 timeslots 1-24
frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
description Connection to xxxxxxxxxxxxxxxxxxxxxxxxx
ip address 64.175.xxx.xxx 255.255.255.0
ip access-group 179 in
no ip redirects
no ip unreachables
ip directed-broadcast
no ip proxy-arp
no cdp enable
frame-relay interface-dlci 16
!
interface FastEthernet0
description xxxxxxxxxxxx LAN
ip address 66.xxx.xxx.1 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
speed auto
full-duplex
no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 64.175.xxx.xxx
ip route 192.168.2.0 255.255.255.0 66.xxx.xxx.2
no ip http server
!
logging source-interface Serial0.1
logging xxx.xxx.xxx.xxx
access-list 178 permit ip 192.168.2.0 0.0.0.255 any
!
access-list 179 deny ip 127.0.0.0 0.255.255.255 any log-input
access-list 179 deny ip any 127.0.0.0 0.255.255.255 log-input
access-list 179 deny ip 224.0.0.0 31.255.255.255 any log-input
access-list 179 deny ip 10.0.0.0 0.255.255.255 any log-input
access-list 179 deny ip 172.16.0.0 0.15.255.255 any log-input
access-list 179 deny icmp any any traceroute log-input
access-list 179 deny tcp any any eq 1434 log-input
access-list 179 deny udp any any eq 1434 log-input
access-list 179 deny 53 any any
access-list 179 deny 55 any any
access-list 179 deny 77 any any
access-list 179 deny pim any any
access-list 179 deny tcp any any eq 135
access-list 179 deny udp any any eq 135
access-list 179 deny udp any any eq 445
access-list 179 deny tcp any any eq 445
access-list 179 deny tcp any any eq 88
access-list 179 deny tcp any any eq pop3
access-list 179 deny tcp any any eq 143
access-list 179 deny tcp any any eq 5554
access-list 179 deny tcp any any eq 9996
access-list 179 permit tcp any any established
access-list 179 permit udp any eq domain any
access-list 179 permit udp any host 66.xxx.xxx.2 eq isakmp
access-list 179 permit esp any host 66.xxx.xxx.2
access-list 179 permit ahp any host 66.xxx.xxx.2
access-list 179 permit udp any host 66.xxx.xxx.2 eq 4500
access-list 179 permit udp any host 66.xxx.xxx.2 eq 22
access-list 179 permit icmp any any echo-reply
access-list 179 permit icmp any any time-exceeded
access-list 179 permit icmp any any administratively-prohibite
access-list 179 deny ip any any log-input
no cdp run
snmp-server community xxxxxxxxxxxx RO
!
line con 0
exec-timeout 0 0
password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
flowcontrol hardware
line aux 0
line vty 0 4
password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
!
scheduler allocate 4000 1000
end
cisco#
!==end 1750 edge router=============
!==beg pix515====================
pixfirewall# sh ru
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list out_in permit icmp any any echo-reply
access-list out_in permit icmp any any echo
access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
access-list out_in permit icmp any any time-exceeded
access-list in_out permit ip any any
access-list nonat remark bypasses natting for vpn connections
access-list nonat permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
access-list split remark split tunneling for vpn clients
access-list split permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap debugging
logging host inside 192.168.2.5
mtu outside 1500
mtu inside 1500
ip address outside 66.xxx.xxx.2 255.255.255.224
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool CLIENTS 172.16.99.1-172.16.99.254
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp 66.xxx.xxx.2 ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
access-group out_in in interface outside
access-group in_out in interface inside
route outside 0.0.0.0 0.0.0.0 66.xxx.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxxxxxx
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dyna 10 set transform-set myset
crypto map mymap 99 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup xxxxxxxxxxx address-pool CLIENTS
vpngroup xxxxxxxxxxx dns-server 192.168.2.5
vpngroup xxxxxxxxxxx wins-server 192.168.2.5
vpngroup xxxxxxxxxxx split-tunnel split
vpngroup xxxxxxxxxxx idle-time 1800
vpngroup xxxxxxxxxxx password ********
telnet timeout 15
ssh timeout 5
console timeout 0
username xxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
terminal width 80
Cryptochecksum:xxxxxxxxxxx
: end
pixfirewall#
!==end pix515====================
!==beg 1750 edge router=============
cisco#sh ru
Using 3935 out of 29688 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxx
!
logging buffered 4096 notifications
no logging console
aaa new-model
aaa authentication login default enable
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
no ip source-route
no ip domain-lookup
ip domain-name xxxxxxxxxxxxxxx
ip name-server 206.xx.xx.12
ip name-server 206.xx.xx.12
!
ip audit notify log
ip audit po max-events 100
ip cef
!
interface Serial0
description PB CKT xxxxxxxxxxxxxxxxxxx / PBI xxxxxxxxxxxxxx
no ip address
ip access-group 178 in
no ip redirects
no ip unreachables
ip nat outside
encapsulation frame-relay IETF
fair-queue
service-module t1 timeslots 1-24
frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
description Connection to xxxxxxxxxxxxxxxxxxxxxxxxx
ip address 64.175.xxx.xxx 255.255.255.0
ip access-group 179 in
no ip redirects
no ip unreachables
ip directed-broadcast
no ip proxy-arp
no cdp enable
frame-relay interface-dlci 16
!
interface FastEthernet0
description xxxxxxxxxxxx LAN
ip address 66.xxx.xxx.1 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
speed auto
full-duplex
no cdp enable
!
ip classless
ip route 0.0.0.0 0.0.0.0 64.175.xxx.xxx
ip route 192.168.2.0 255.255.255.0 66.xxx.xxx.2
no ip http server
!
logging source-interface Serial0.1
logging xxx.xxx.xxx.xxx
access-list 178 permit ip 192.168.2.0 0.0.0.255 any
!
access-list 179 deny ip 127.0.0.0 0.255.255.255 any log-input
access-list 179 deny ip any 127.0.0.0 0.255.255.255 log-input
access-list 179 deny ip 224.0.0.0 31.255.255.255 any log-input
access-list 179 deny ip 10.0.0.0 0.255.255.255 any log-input
access-list 179 deny ip 172.16.0.0 0.15.255.255 any log-input
access-list 179 deny icmp any any traceroute log-input
access-list 179 deny tcp any any eq 1434 log-input
access-list 179 deny udp any any eq 1434 log-input
access-list 179 deny 53 any any
access-list 179 deny 55 any any
access-list 179 deny 77 any any
access-list 179 deny pim any any
access-list 179 deny tcp any any eq 135
access-list 179 deny udp any any eq 135
access-list 179 deny udp any any eq 445
access-list 179 deny tcp any any eq 445
access-list 179 deny tcp any any eq 88
access-list 179 deny tcp any any eq pop3
access-list 179 deny tcp any any eq 143
access-list 179 deny tcp any any eq 5554
access-list 179 deny tcp any any eq 9996
access-list 179 permit tcp any any established
access-list 179 permit udp any eq domain any
access-list 179 permit udp any host 66.xxx.xxx.2 eq isakmp
access-list 179 permit esp any host 66.xxx.xxx.2
access-list 179 permit ahp any host 66.xxx.xxx.2
access-list 179 permit udp any host 66.xxx.xxx.2 eq 4500
access-list 179 permit udp any host 66.xxx.xxx.2 eq 22
access-list 179 permit icmp any any echo-reply
access-list 179 permit icmp any any time-exceeded
access-list 179 permit icmp any any administratively-prohibite
access-list 179 deny ip any any log-input
no cdp run
snmp-server community xxxxxxxxxxxx RO
!
line con 0
exec-timeout 0 0
password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
flowcontrol hardware
line aux 0
line vty 0 4
password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
!
scheduler allocate 4000 1000
end
cisco#
!==end 1750 edge router=============
!==beg pix515====================
pixfirewall# sh ru
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname pixfirewall
domain-name xxxxxxxxx
fixup protocol dns maximum-length 512
no fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list out_in permit icmp any any echo-reply
access-list out_in permit icmp any any echo
access-list out_in permit tcp any host 66.xxx.xxx.2 eq ssh
access-list out_in permit icmp any any time-exceeded
access-list in_out permit ip any any
access-list nonat remark bypasses natting for vpn connections
access-list nonat permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
access-list split remark split tunneling for vpn clients
access-list split permit ip 192.168.2.0 255.255.255.0 172.16.99.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
logging trap debugging
logging host inside 192.168.2.5
mtu outside 1500
mtu inside 1500
ip address outside 66.xxx.xxx.2 255.255.255.224
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool CLIENTS 172.16.99.1-172.16.99.254
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list nonat
nat (inside) 10 192.168.2.0 255.255.255.0 0 0
static (inside,outside) tcp 66.xxx.xxx.2 ssh 192.168.2.22 ssh netmask 255.255.255.255 0 0
access-group out_in in interface outside
access-group in_out in interface inside
route outside 0.0.0.0 0.0.0.0 66.xxx.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxxxxxx
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dyna 10 set transform-set myset
crypto map mymap 99 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup xxxxxxxxxxx address-pool CLIENTS
vpngroup xxxxxxxxxxx dns-server 192.168.2.5
vpngroup xxxxxxxxxxx wins-server 192.168.2.5
vpngroup xxxxxxxxxxx split-tunnel split
vpngroup xxxxxxxxxxx idle-time 1800
vpngroup xxxxxxxxxxx password ********
telnet timeout 15
ssh timeout 5
console timeout 0
username xxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
username xxxxxxxxx password xxxxxxxxxxxxxxxx encrypted privilege 2
terminal width 80
Cryptochecksum:xxxxxxxxxxx
: end
pixfirewall#
!==end pix515====================
Can you ping out to the internet from the cisco router? Can you ping out to the internet from the cisco pix? Otherwise my tired brain isn't seeing anything obviously wrong. Can you confirm the IP, mask and gateway of the PC's on the pix subnet? The natting looks a little weird to me, but I'm not sure that anything is wrong with it, I just haven't seen it done that way.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
AndrewCink:
the NATing seems different than most lists i've seen on the net too. if you know a better or more standard way let me know.
from the router pinging yahoo: yes
from the pix pinging yahoo: no
==========================
MrHusy:
i'll remove that redundant acl statement
from the pix pinging it's outside int: yes
from the pix pinging the inside int on routernext hop): yes
from the pix pinging yahoo: no
==========================
lrmoore:
i'll remove that static statement and see what happens. i believe that was added so public users could ssh into that box at 192.168.2.22. is an access list better for that than say, a static statement?
more later.... thanks!
the NATing seems different than most lists i've seen on the net too. if you know a better or more standard way let me know.
from the router pinging yahoo: yes
from the pix pinging yahoo: no
==========================
MrHusy:
i'll remove that redundant acl statement
from the pix pinging it's outside int: yes
from the pix pinging the inside int on routernext hop): yes
from the pix pinging yahoo: no
==========================
lrmoore:
i'll remove that static statement and see what happens. i believe that was added so public users could ssh into that box at 192.168.2.22. is an access list better for that than say, a static statement?
more later.... thanks!
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
made suggested changes, yet still cannot get out to the Internet... certainly open to more suggestions....
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Also use "clear xlate" command
pix#clear xlate
pix#clear xlate
Still waiting for your feedback about the following
*When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router
*When you unlink the pix from router's interface and connect a PC directly to Routers interface and assign 66.xxx.xxx.2 ip and 66.xxx.xxx.1 gateway to PC, is PC able to connect to internet? If not, something is wrong with router
ASKER
still cannot go outside, sorry to say. `dig' can't locate dns servers, web browsing via ip address doesn't work. i really don't see anything in syslog where the pix is dropping all these packets, so i'm even more stumped.
are we sure the issue is with the pix and not the edge router?
are we sure the issue is with the pix and not the edge router?
Demus, you cant still go outside when the PC connected to router directly without PIX as i mentioned above?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
MrHusy: i'll put a notebook on a hub in between and test this. it'll have to wait until monday.
lrmoore: I see something in your router.....
maybe a leftover from a previous config. i'll remove it on monday what i can get back into the building.
more on monday, thanks....
lrmoore: I see something in your router.....
maybe a leftover from a previous config. i'll remove it on monday what i can get back into the building.
more on monday, thanks....
ASKER
MrHusy:
with a notebook in between the edge router and the pix515, i cannot do dns lookups nor ping any site outside. i can get as far as the inside interface of the edge router. something amiss on the edge router's ACL. i'll take a closer look at it.
more later....
with a notebook in between the edge router and the pix515, i cannot do dns lookups nor ping any site outside. i can get as far as the inside interface of the edge router. something amiss on the edge router's ACL. i'll take a closer look at it.
more later....
Hi demus
Now you have to focus on router. Please do not miss lrmoore's suggestions.
Regards
Now you have to focus on router. Please do not miss lrmoore's suggestions.
Regards
ASKER
up and running, packets flowing. many thanks to lrmoore and mrhusy. if you do not mind, i'll split the points due to both of you helped me out a lot. once again many thanks!
Thanks!