Link to home
Start Free TrialLog in
Avatar of szshan
szshan

asked on

Internet link is up but i am unable to browse any website

we have 512k link on leased line, leased line modem is directly attahed with cisco router by serial cable and router is attached with cisco PIX 50E firewall and PIX is attached with switch and all PC are connected with switch...... every thing was working fine but from yesterday no one able to browse any websites but I can able to telnet the router from other locations and also able to access my servers remotely by VPN client software [remote desktop]
Avatar of joefreedom
joefreedom
Flag of United States of America image

Can you navigate to websites using IP addresses?  Have you checked your DNS settings?  Is there a security configuration on the PIX that may be blocking port 80 outbound?

Check your DNS configuration
try browsing to http://74.125.67.100/ with one of the machines connected to the LAN, it should resolve to google if there is a DNS issue.
Avatar of szshan
szshan

ASKER

i have tried i guess this is a DNS or 80 blocking issue ... can you tell me how i trouble shoot it
Did it work or did it fail when you tried to navigate to google using the IP address?  If it worked this is a DNS issue, it it failed we have something else going on...maybe the PIX blocking port 80.  We need to know if it worked or not first.
Avatar of szshan

ASKER

No that not works try port 80
Sorry bud, i'm not a cisco guru but I can try to help out until a more qualified expert joins us....  Go to this site: http://www.netcraftsmen.net/resources/archived-articles/377-managing-a-cisco-pix-with-pdm.html

You need to determine the IP address of your PIX device then use a browser to connect to the graphical user interface.  Using the above guide checkout how to bring-up the access rules, look at the second screen-shot from the top.  Once you are logged into the pix it looks like you just select "Configuration", then "access rules".

However, this previous EE article states in regards to a PIX configuration:
"for outbound traffic you do not have to do anything as by default everything is allowed from inside to a lower securiy interface (outside) so if the connection is initiated from the inside you will be fine. "
https://www.experts-exchange.com/questions/21146200/Open-Ports-in-PIX-501-through-PDM-not-command-Line.html

If this is true you probably have something else occuring in your environment.  Can you think of anything that may have changed since yesterday when everything was working?
Might be worth a call to your ISP in the meantime as well... they may have something going on with their configuration if everything was working fine yesterday and today you are having difficulties.  They also may have some technical staff that could more easily assist you with troubleshooting.
Avatar of szshan

ASKER

i have PDM installed in PIX but problem it also not opening its asking me a user id and password and after that its just process and process no managemnt window comes
Avatar of szshan

ASKER

i alreday phoned to ISP and they said all is fine from there end.... : (
Have you checked the status of the switch and your other networking devices for issues?  Specifically check the switch for indicator lights and signs of it moving traffic...
Avatar of szshan

ASKER

i can loggin on to PIX and router so password are right as far as switch is concern i belive its working fine as users can acces the shares folder and i can access server from other location...
Try a telnet connection to the PIX for command line interaction
Avatar of szshan

ASKER

i did and its work and i can ping that ip also but problem browsing.
If you can telnet into the PIX, issue a "show access-list" command and copy/paste the results here.

Also you may consider the following, now again, I'm NOT certain the PIX is even the culprit in your situation, so take this all with a grain of salt.

"If you want to see messages concerning the PIX dropping packets, you should manually add a deny statement at the very end of your ACL that drops all traffic.  Cisco highly recommends that you don't log these messages to the console, but to a syslog server instead, because a very busy network could easily flood the console and cause the PIX to perform extra processing."

"access-list ACL_ID deny ip any any"

If you choose to try this, you want this at the very bottom of your ACL so pick an appropriate ACL_ID.

Source: http://books.google.com/books?id=GMTsxvrYGMoC&pg=PA176&lpg=PA176&dq=pix+view+acl&source=bl&ots=Dx5hxUoI1l&sig=dxyyQvstytjGnTpUSlKJT6fIGbE&hl=en&ei=0HZfSoaRMpD-M-7xta4C&sa=X&oi=book_result&ct=result&resnum=7
Are you passing DNS port 53 (UDP AND TCP) to the outside on the PIX? At first glance, like everyone else sounds like DNS. Telnet uses a different port than DNS.
ASKER CERTIFIED SOLUTION
Avatar of szshan
szshan

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial