asked on

PIX 506e cannot access web pages

Thank you all for your assistance. Here is my issue... I can see my webpages from outside my network, and if I type in http://10.197.11.x in my browser internally I can as well. How do I allow users the ability to goto www.myhost.com from my internal network. Here is my config file:

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ************ encrypted
passwd ****************** encrypted
hostname PIX506E
domain-name myhost.com
clock timezone EST 21
clock summer-time EST recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list out_in permit tcp any interface outside eq domain
access-list out_in permit udp any interface outside eq domain
access-list out_in permit tcp any interface outside eq ssh
access-list out_in permit tcp any interface outside eq 8000
access-list out_in permit tcp any interface outside eq 8001
access-list out_in permit tcp any interface outside eq 7000
access-list out_in permit tcp any interface outside eq 5900
access-list out_in permit tcp any interface outside eq pop3
access-list out_in permit tcp any interface outside eq imap4
access-list out_in permit tcp any interface outside eq smtp
access-list out_in permit tcp any interface outside eq www
access-list out_in deny ip any any
access-list NatControl permit ip 0.0.0.0 255.255.255.0 10.197.11.0 255.255.255.0
access-list SplitTunnel permit ip 0.0.0.0 255.255.255.0 10.197.11.0 255.255.255.0
pager lines 24
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside 71.98.xxx.xx 255.255.255.0
ip address inside 10.197.11.x 255.255.254.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 10.197.11.xxx-10.197.11.xxx
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
static (inside,outside) tcp interface www 10.197.11.xx www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 10.197.11.xx smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface domain 10.197.xx.100 domain netmask 255.255.255.255 0 0
static (inside,outside) udp interface domain 10.197.xx.100 domain netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp 10.197.11.xx ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ssh 10.197.11.xx ssh netmask 255.255.255.255 0 0
static (inside,outside) tcp interface pop3 10.197.11.xx pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 8000 10.197.11.xx 8000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 8001 10.197.11.xx 8001 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 8001 10.197.11.xx 8001 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 8000 10.197.11.xx 8000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface imap4 10.197.11.xx imap4 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 7000 10.197.11.xx 7000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5900 10.197.11.xx 5900 netmask 255.255.255.255 0 0
access-group out_in in interface outside
route outside 0.0.0.0 0.0.0.0 71.98.xxx.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 10.197.10.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
fragment chain 1
sysopt connection permit-ipsec
crypto ipsec transform-set AESSHAset esp-aes esp-sha-hmac
crypto dynamic-map dynmap 30 set transform-set AESSHAset
crypto map clientvpnmap 20 ipsec-isakmp dynamic dynmap
crypto map clientvpnmap interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup clientremote address-pool vpnpool
vpngroup clientremote dns-server 68.238.0.12 68.238.112.12
vpngroup clientremote default-domain nacsolutions.net
vpngroup clientremote split-tunnel SplitTunnel
vpngroup clientremote idle-time 4000
vpngroup clientremote password ********
vpngroup client idle-time 1800
telnet timeout 5
ssh 10.197.0.0 255.255.224.0 inside
ssh timeout 15
console timeout 0
terminal width 80
Cryptochecksum:83617ef87df4c28cdac531f61308eec3
: end

batry_boy

Since you are using port redirection on the firewall, your public outside interface IP address on the firewall needs to be used in registering a DNS A record for the website you wish to advertise. So whoever you are using for your domain name registration needs to be contacted and told to add an "A" record for "www" that points to 71.98.x.x (whatever is the one that is on the outside interface of your firewall). Once that is done, external users will be able to type in www.<whatever_your_domain_name_is>.com and they will be pointed to 71.98.x.x (your firewall) which will then perform port redirection and allow the HTTP traffic inbound to your server at 10.197.11.x.

Make sense?

gimmiecpt

ASKER

Bartry,
Thank you for the quick response. External users can already get to my website, it is the internal users that cannot type in www.mydomain.com and get to it.

ASKER CERTIFIED SOLUTION

batry_boy

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

rsivanandan

The above should fix it. DNS Doctoring is the only fix needed.

Further reading;

http://www.rsivanandan.com/?p=20

Cheers,
Rajesh