Can't access Internet Pix501

[ensorg]

Hi All,

Hopefully somebody here can help me! I have a PIX 501 and an unable to access the internet through it. I'll post my config and setup below, hopefully someone can help.

I've replaced my IP addresses with 1.1.1.1 for the router and 1.1.1.2 for static IP.

Network Setup
INTERNET
|
ROUTER (1.1.1.1)
|
PIX OUTSIDE (1.1.1.2)
|
PIX INSIDE (192.168.1.1)
|
SWITCH
|
CLIENT PC (192.168.1.10)

The problem I am having is that on the client PC I am unable to access the internet thought the PIX or Ping the router through the PIX (I set the default gateway on the PC to be 192.168.1.1)
I first assumed that the PIX was not getting a connection with the router, so I telnetted on and was able to ping the router...
tmaxwall# ping inside 192.168.1.10
192.168.1.10 response received -- 0ms
192.168.1.10 response received -- 0ms
192.168.1.10 response received -- 0ms
tmaxwall# ping outside 1.1.1.1
1.1.1.1 response received -- 0ms
1.1.1.1 response received -- 0ms
1.1.1.1 response received -- 0ms
tmaxwall# ping outside 1.1.1.2
1.1.1.2 response received -- 0ms
1.1.1.2 response received -- 0ms
1.1.1.2 response received -- 0ms

So as far as I can tell this seems to be OK.
I have pasted my config below, hopefully somebody will spot something I've missed or configured incorrectly.

PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname tmaxwall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list ping_acl permit icmp any any
access-list acl_out permit icmp any any
pager lines 24
logging on
logging buffered debugging
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 1.1.1.1 255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit info action alarm drop reset
ip audit attack action alarm drop reset
pdm location 192.168.1.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group ping_acl in interface inside
route outside 0.0.0.0 0.0.0.0 213.2.198.137 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80

 

[routerman]

Hi,

From your posted configuration I see:

access-list ping_acl permit icmp any any
access-group ping_acl in interface inside

This will only allow ICMP from the inside to the outside, and drop everything else.

I'd suggest for testing remove the access-group statement, make sure you have the required connecitvity. Then you can lock down access from the inside to the outside with access-lists.

 

[ensorg]

Routerman, thank you! That was the problem.