Cisco PIX and DNS

[Raymo1]

Hi

Im having a problem with a Cisco Pix and wondering if anyone has came across this before.

I can use my laptop, symbian phone and a MAC to access any web-site when using a full web address like

http://www.google.com

Any site specified by IP address or not having a .com suffix cannot be connected to. Any thoughts? DNS works for .com sites, and DNS resolves for others with no problem, but a connection just results in a one way request and no reply

Thanks

Raymo

 

[North323]

post a scrubbed config of your PIX

 

[Raymo1]

Hi

Thanks for the reply, i wont be able to get that till next week, once i have it i will get it up

Thanks

 

[Raymo1]

Hi

Please find attached my settings... Any info on this would be great

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password Ajx0NpYaWDDx98Zn encrypted
passwd Ajx0NpYaWDDx98Zn encrypted
hostname IGphonePix
domain-name indigovision.com
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
no fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.0.0.0 indigovision
name 10.0.0.3 DNS2
name 217.150.123.65 GATEWAY
name 192.168.10.2 hal
name 217.150.123.92 ED
name 85.189.102.5 DNS
name 93.152.35.181 IGHomeOutside
name 192.168.10.0 IGHomeNetwork
name 192.168.10.1 IGHomeInside
access-list inside_access_in permit icmp any any
access-list inside_access_in permit tcp any any
access-list inside_access_in permit tcp any any eq www
access-list inside_access_in permit tcp any any eq https
access-list inside_access_in permit tcp any any eq ftp
access-list inside_access_in permit ip any indigovision 255.255.255.0
access-list inside_access_in permit tcp any any eq domain
access-list inside_access_in permit udp any any eq domain
access-list inside_access_in permit tcp any any eq telnet
access-list inside_access_in permit tcp any any eq 49400
access-list inside_access_in permit udp any any
access-list acl_out permit icmp any any
access-list outside_access_in permit tcp host 217.150.123.90 any eq telnet
access-list Edinburgh permit ip IGHomeNetwork 255.255.255.0 indigovision 255.255.255.0
access-list inside_nat0_outbound permit ip IGHomeNetwork 255.255.255.0 indigovision 255.255.255.0
pager lines 20
logging console debugging
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside IGHomeInside 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location indigovision 255.255.255.0 outside
pdm location 10.0.0.8 255.255.255.255 inside
pdm location 10.0.0.8 255.255.255.255 outside
pdm location 10.0.0.1 255.255.255.255 inside
pdm location 217.150.123.64 255.255.255.192 outside
pdm location hal 255.255.255.255 inside
pdm location 217.150.123.90 255.255.255.255 outside
pdm location IGHomeNetwork 255.255.255.0 inside
pdm location indigovision 255.224.0.0 inside
pdm location indigovision 255.224.0.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside indigovision 255.224.0.0 ED 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host 10.0.0.8 1qaz2wsx timeout 10
aaa-server LOCAL protocol local
aaa authentication telnet console LOCAL
http server enable
http 217.150.123.64 255.255.255.192 outside
http IGHomeNetwork 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection tcpmss 0
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600 kilobytes 2304000
crypto map outsideMAP 11 ipsec-isakmp
crypto map outsideMAP 11 match address Edinburgh
crypto map outsideMAP 11 set peer ED
crypto map outsideMAP 11 set transform-set ESP-DES-MD5
crypto map outsideMAP client configuration address initiate
crypto map outsideMAP client configuration address respond
crypto map outsideMAP client authentication RADIUS
crypto map outsideMAP interface outside
isakmp enable outside
isakmp enable inside
isakmp key ******** address ED netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 28800
telnet 217.150.123.90 255.255.255.255 outside
telnet 10.0.0.1 255.255.255.255 inside
telnet IGHomeNetwork 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group pppoe_group request dialout pppoe
vpdn group pppoe_group localname 66557-1@griffin.broadband
vpdn group pppoe_group ppp authentication chap
vpdn username 66557-1@griffin.broadband password ********* store-local
dhcpd address hal-192.168.10.32 inside
dhcpd dns DNS 85.189.39.5
dhcpd lease 86400
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
username telnet password ysiS7HMDIgI0.0oT encrypted privilege 15
terminal width 80
Cryptochecksum:7866abbea4be00ffbd17c3b2dd257aa0
: end
[OK]

Thanks

Raymo

 

[mjoyner]

Raymo,
Hey, Im a beginner, but I noticed on your config you have:

access-list inside_access_in permit tcp any any
access-list inside_access_in permit tcp any any eq www
access-list inside_access_in permit tcp any any eq https
access-list inside_access_in permit tcp any any eq ftp

What happens when you go from tcp ANY/ANY and then to specific ports, is you tcp ANY/ANY gone?

[root@netwatch ~]# yum remove windows
Loaded plugins: fastestmirror
Setting up Remove Process
No Match for argument: windows
No Packages marked for removal

OH YEAH!

 

[Supergrrover]

this can be taken off the config -
access-group inside_access_in in interface inside
By default anything inside can go out. Take the ACL off and see what happens.

Are you sure the DNS servers are setup correctly?


Brent
Systems Engineer / Consultant
CCNP, CCSP