first time pix user

[igolo]

I've tried multiple configs but get the same results (nothing). I can't ping internal to external, can't browse the web. I gave my laptop one of my public IP's and still can't ping external or internal interface of the Pix.

Below is a copy of config; it's a config from Cisco's website (modified).

PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password kXiRWD4npYO2gXTT encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname CiscoPix
domain-name mad4networks.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit tcp any host 65.105.55.213 eq www
access-list 100 permit tcp any host 65.105.55.210 eq smtp
access-list 100 permit tcp any host 65.105.55.213 eq ftp
pager lines 24
logging on
logging buffered errors
logging trap notifications
logging host inside 10.1.1.8
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 65.105.55.210 255.255.255.248
ip address inside 10.1.1.254 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.1.1.4 255.255.255.255 inside
pdm location 10.1.1.8 255.255.255.255 inside
pdm location 10.1.1.254 255.255.255.255 inside
pdm location 10.1.40.1 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 65.105.55.213 10.1.40.1 netmask 255.255.255.255 0 0
static (inside,outside) 65.105.55.210 10.1.1.4 netmask 255.255.255.255 0 0
static (inside,outside) 10.1.1.254 10.1.1.254 netmask 255.255.255.255 0 0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 65.105.55.209 1
route inside 10.1.1.254 255.255.255.255 65.105.55.209 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 10.1.1.254 255.255.255.255 inside
http 10.1.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 10.1.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:5571d5c48b28aa6911ca5de2f28c9c91
: end
[OK]

 

[br0ck]

Add this to get ping working:
access-list 100 permit icmp any any

I would remove these:
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable

remove all this:
route inside 10.1.1.254 255.255.255.255 65.105.55.209 1

static (inside,outside) 65.105.55.213 10.1.40.1 netmask 255.255.255.255 0 0
static (inside,outside) 65.105.55.210 10.1.1.4 netmask 255.255.255.255 0 0
static (inside,outside) 10.1.1.254 10.1.1.254 netmask 255.255.255.255 0 0

that should get you going


Brock D. Mowry
Hardware Specialist

http://www.iNECTA.com

 

[yizhar]

HI.

I would remove the following unneeded lines:
> static (inside,outside) 10.1.1.254 10.1.1.254
> route inside 10.1.1.254 255.255.255.255 65.105.55.209 1

I recommend using PDM for the configuration, and changing the command line only when needed.
This can help you as a newbie, and it is also easier to manage the pix afterwards.

Your access-list 100 looks fine to me.

You will need to clear the ARP cache on the router by using "clear ip arp" or simply reloading the router.

Try to telnet to the router "telnet 65.105.55.209", what do you get?

Try to telnet from the router to an open port on your servers, for example type this at the router console:
telnet 65.105.55.210 25
telnet 65.105.55.213 21
What do you get?

Can the servers ping the pix inside interface, and vice versa?
Can the router ping the pix outside interface, and vice versa?

The syslog messages are very useful for troubleshooting. Use them.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[igolo]

Thanks for the help your solutions worked great.