Global address? Users cant get online but server can? 1

[trojanman]

What does this line do?

global (outside) 1 X.X.X.116 netmask 255.255.255.248

For some reason our users cant get on the internet but our .4 server can. The users get a dynamic IP from the .4 server which is also DNS. Both DNS and DHCP services are working properly.

The reason I ask about the global command is because our ISP told us that a X.X.X.116 address was spamming them. They removed the X.X.X.116 from our address pool. Once that happened, our clients can no longer get online. Weird though because the server can. No other changes have been made and they are all pointing to the same .254 gateway.

Attached is the pix config:

-----------------------------------------------------------

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
clock timezone PST -8
clock summer-time PDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
no names
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.254.0 255.255.255.0
pager lines 24
logging timestamp
logging trap critical
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.117 255.255.255.248
ip address inside 192.168.1.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPOOL 192.168.254.1-192.168.254.254
pdm logging informational 100
pdm history enable
arp timeout 14400

global (outside) 1 x.x.x.116 netmask 255.255.255.248

nat (inside) 0 access-list 101
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
static (inside,outside) x.x.x.114 192.168.1.4 netmask 255.255.255.255 0 0
static (inside,outside) x.x.x.115 192.168.1.9 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit tcp host x.x.x.114 eq smtp any
conduit permit tcp host x.x.x.114 eq pop3 any
conduit permit tcp host x.x.x.114 eq

http://www any

conduit permit tcp host x.x.x.115 eq smtp any
conduit permit tcp host x.x.x.115 eq pop3 any
conduit permit tcp host x.x.x.115 eq

http://www any

conduit permit tcp host x.x.x.115 eq https any
conduit permit udp x.x.x.112 255.255.255.248 eq isakmp any
conduit permit esp x.x.x.112 255.255.255.248 any
conduit permit ah x.x.x.112 255.255.255.248 any
route outside 0.0.0.0 0.0.0.0 x.x.x.113 1
route inside 10.0.0.0 255.0.0.0 192.168.1.1 1
route inside 192.168.50.0 255.255.255.0 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 20 set transform-set myset
crypto map mymap 20 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0

: end
pix#

 

[Supergrrover]

That line
global (outside) 1 X.X.X.116 netmask 255.255.255.248
matches up with your
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
What this does is take anybody on the internal 192.168.1.0/24 network and gives it an address from the external or global (public) ip of x.x.x.116 netmask 255.255.255.248.
If they blocked that IP then you no longer have internet access for your internal hosts who do not have a static address mapping on the pix - like the servers.
You can use the x.x.x.117 address for this purpose.
global (outside) 1 X.X.X.117 netmask 255.255.255.248
I would find the internal spammer (virus) and stop it or restrict smtp traffic to your known servers or they will shut out that address as well. Then you are really in trouble. They should give you back your extra IP if you prove the spam has stopped.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[trojanman]

Thank You!