Solved

basic internet config on PIX 501 using PDM

Posted on 2008-10-22
22
418 Views
Last Modified: 2009-01-21
I have a config that the PDM on a PIX 501 configured which looks like this

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password sjMKnkqrAFoDv9qV encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname NEMLPixBkup
domain-name global.ad
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_access_in permit ip any interface outside
access-list inside_access_in permit ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 80.5.92.41 255.255.255.248
ip address inside 192.168.72.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 194.129.160.0 255.255.255.0 inside
pdm location 194.129.161.0 255.255.255.0 inside
pdm location 10.85.192.0 255.255.255.0 inside
pdm location 193.196.133.0 255.255.255.0 inside
pdm location 192.168.6.128 255.255.255.248 inside
pdm location 10.0.0.0 255.0.0.0 inside
pdm location 192.168.72.0 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 80.5.92.46 1
route inside 10.0.0.0 255.0.0.0 192.168.72.252 1
route inside 10.85.192.0 255.255.255.0 192.168.72.252 1
route inside 192.168.6.128 255.255.255.248 192.168.72.251 1
route inside 193.196.133.0 255.255.255.0 192.168.72.251 1
route inside 194.129.160.0 255.255.255.0 192.168.72.251 1
route inside 194.129.161.0 255.255.255.0 192.168.72.251 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.72.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.72.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.72.254-192.168.72.254 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:23b0cc657c89bd4b3047cab286633a0d
: end
[OK]


The problem is that from the inside interface none of the other internal networks are contactable and neither can you reach the web though from the outside interface you can get external traffic

Is there some basic access-list missing from this that the PDM hasnt/doesnt do?

cheers
0
Comment
Question by:redmayne
  • 8
  • 8
  • 6
22 Comments
 
LVL 32

Expert Comment

by:harbor235
ID: 22776527

You have created an access-list but you have not applied it anywhere;

ip access-group <access-list_name> <in/out> interface <interface name>
The access-list you created is dangerous since you are allowing everything

Youo are NATing everything, anyone form network 192.168.72.0 255.255.255.0  should be able to get to the internet asl long as this is the correct gateway address (80.5.92.46 )?

What are you trying todo? what fails? What internal networks? I assume you mean the following
route inside 10.0.0.0 255.0.0.0 192.168.72.252 1
route inside 10.85.192.0 255.255.255.0 192.168.72.252 1
route inside 192.168.6.128 255.255.255.248 192.168.72.251 1
route inside 193.196.133.0 255.255.255.0 192.168.72.251 1
route inside 194.129.160.0 255.255.255.0 192.168.72.251 1
route inside 194.129.161.0 255.255.255.0 192.168.72.251 1

Are the gateways correct? The firewall will not like traffic sourced from a network other than 192.168.72.0/24 arriving on the inside interface. You may need to disable reverse-path forwarding

no ip verify reverse-path interface inside

harbor235 ;}

0
 

Author Comment

by:redmayne
ID: 22776575
sorry does the following not apply the group:
access-group inside_access_in in interface inside
where else does it need applied and how

also i wont be leaving the rule set as it is i just want o make sure i can do something!!!
yeah the routes inside i dont understand why it wouldnt just route inside and act as the router as opposed to blocking it

thanks for your help
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22777618
Right, I assume you mean "ip access-group inside_access_in in interface inside"

i did not see it in the config, gotcha

Like i said above, a firewall does not like if it sees packets arriving at the inside interface that are not sourced from the same network as the ip address of the inside interface of the firewall, remember, its not a router it's a security device.

harbor235 ;}
0
 

Author Comment

by:redmayne
ID: 22777699
yeah i get that except the network i am trying to reach the outside world from is actually the 192.168.72.x/24

that is not able to access outside either even with the config there - for some reason it is blocking anything from inside>outside....
iot must be something stupid i've missed but for the life of me i can't see what
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22777917


How are you testing that you cannot get there? Is the default GW of the inside hosts set to 192.168.72.253?  Is there a device upstream that is filtering traffic?

Remove the access-list it's nit the problem, traffic is allowed from a higher security level to a lower without a problem.

harbor235 ;}
0
 

Author Comment

by:redmayne
ID: 22777953
Yeah and also it doesnt work when you try from the inside interface to the outside

the access-list was created by PDM when specifying outbound rule from inside
i think it should be there to be honest
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22778324

How are you testing that you cannot get there?


harbor235 ;}
0
 
LVL 2

Expert Comment

by:JimmyLarsson
ID: 22778417
Hello

If you upgrade the Pix to v7.x you will be able to route traffic back the same wah it came in in the pix. In that case you could use the pix as default gateway for your LAN and still reach other networks behind routers connected to your lan.

Br Jimmy
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22778784


You cannot upgrade teh 501 to 7.x code.

harbor235 ;}
0
 
LVL 2

Expert Comment

by:JimmyLarsson
ID: 22779055
Of course not. Sorry, my mistake.
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22779132

np, I do the same thing   ;}

harbor235 ;}
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:redmayne
ID: 22783944
so can i aks why it is not possible to route internally with a PIX?
does this mean i need a router as a default gateway just to route internally?

also i am testing the interface from boith a host on 192.168.72.x and also from the inside interface and no traffic goes externally whereas if i try from the outside interface i can reach the net

I can select which interface from the PDM to ping

is this just the worst piece of kit ever?
0
 
LVL 2

Accepted Solution

by:
JimmyLarsson earned 500 total points
ID: 22785405
It is by design. The Pix simply lacks the functionality. Ciscos official (imho quite weak) response to this is "The Pix is a firewall, not a router". However, in newer versions the changed their mind so I guess they have suffered alot because of this over the years. :-)

If You cannot replace the pix with another firewall (I wolud vote for a Cisco ASA!) the other solution is to use another router as default gateway on your LAN. Letting this router route traffic between all internal networks and having a static default route pointing to the Pix.

Br Jimmy
0
 

Author Comment

by:redmayne
ID: 22787251
thanks Jimmy

but that shouldnt stop any outbound traffic from the LAN 192.168.72.x/24
do you have any ideas on why the 192.168 network is unable to get to the internet


0
 
LVL 32

Expert Comment

by:harbor235
ID: 22787740


There is no problem with the config of this device for outbound traffic sourced from 192.169.72.x.

There must be something else blocking

1) Do the hosts have the proper routing setup?
2) Can the host ping 80.5.92.46 ?
3) How do you know no traffic goes externally? The return traffic could be blocked upstream? (see 2)
4) Post output of show access-list
5) Perform all testing from inside host
6) turn up logging
     logging on
     logging buffered informational
7) Check logs for denied packets
8) Report back

harbor235 ;}


0
 

Author Comment

by:redmayne
ID: 22794161
Hey there

The network 192.168.72.x cannot ping 80.5.92.46
or anything outside but the rule allows any any IP so i should in theory get anything

there is nothing after the firewall blocking from the PIX and we have other firewalls (decent ones thankfully!! - i.e. not PIX) that work fine

i have to say i have never seen a f/w that is such a pain to configure.

access-list inside_access_in; 1 elements
access-list inside_access_in line 1 permit ip any any (hitcnt=0)

thats the access lists,
i think they are in the config above too though

cheers
0
 
LVL 2

Expert Comment

by:JimmyLarsson
ID: 22794403
Since your access-list is permitting anything but is not in use (hitcnt=0) it means that there is something wrong. How does you "access-group" config-lines look like?

Br Jimmy
0
 

Author Comment

by:redmayne
ID: 22796125
this is the access-group

access-group inside_access_in in interface inside

again created by the PDM
the hitcnt will be zero as i dont use it all the time right now
i am only testing with it

cheers
0
 
LVL 2

Expert Comment

by:JimmyLarsson
ID: 22796418
Try to apply the access-list and do some testing just to make sure that you will get an raising hitcnt.

Br Jimmy
0
 

Author Comment

by:redmayne
ID: 22796467
is the access-list not already applied,

0
 
LVL 2

Expert Comment

by:JimmyLarsson
ID: 22796588
Maybe I misunderstood you when you wrote "as i dont use it all the time right now". If you havent removed the access-group command try to generate some traffic and make sure that the hitcnt is ticking up.

Br Jimmy
0
 
LVL 32

Expert Comment

by:harbor235
ID: 22803083


REmove the access-list and try again, what does the log say?

no access-group inside_access_in in interface inside

harbor235 ;}
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now