global (outside) 1 interface

[BAsh12]

OK, here goes.

515e-ur, been using a fixed IP address for global pat for over 2 years. On Friday night, the firewall appeared to stop working. After lots of testing we deduced the outside interface was dead. So, we ordered a ne firewall. Arrived today. Loaded the same config and still no success. So we put a minimal config on and still no access, at this time I noticed that anything with a static worked. So, obviously PAT was not working. We tried everything and nothing worked.

The very last thing we tried was "global (outside) 1 interface". It worked! So, I made a static to the old address to my pc, it would not work, all other statics do, eg www, smtp, webmail etc. Why has this one suddenly stopped?

If I put my pc on the address that does not work on the router, it works!

So, after 2 years why why why.

 

[br0ck]

Sounds like an arp issue on the router


Check the head-end router and the pix arp cache
it wouldn't hurt to clear them and let them rebuild

where any changes on the outside interface network
(this might of messed with the ARP cache)

The router is most likely holding the MAC for your PC now


br0ck-

 

[BAsh12]

I agree, it could be arp, however, a brand new pix, with a new mac address? Also, the router had been switched off for over 4 days, we had to use an 837 to ensure that we got mail and gave

http://www access

to our server.

Surely the arp cache would have cleared, and, we re-booted the router on several occaisions.

The router belongs to BT/Demon, so we have no control over it and can not look at its arp table, so that didn't help.

Suspect that we will never know as we have no access to the damn router, I could however, put a minimal config on the 837 and see if that works. Will let you know.

 

[br0ck]

beleve it or not i had a problem with a 1720 and a pix 506 i put a web server on the outside network that had a static statment to that ip

after moving the web server and rebooting the 1720 two or three time as well as the pix the ip would still not respond

only issuing a cl arp on both devices did it free up the ip


can you contact the people who manage the router for support


good luck

 

[BAsh12]

Yes, I can contact them, I have a phone number, username, password, secret answer. GREAT!!!!

But I always seem to get a monkey asking questions like :-

1. Is it plugged in?
2. Are the lights on the router flashing
3. What do you mean IP Address?
4. What is ARP?
5. Do you have any jobs going with training included?

 

[br0ck]

Haha don't you just love that

you got to love level one support

 

[BAsh12]

Just to let you all know, have put the old global static back today, bingo.