How do I allow inside computers to see my outside network?

[marflo500]

Hell0 Everyone,

My setup is as follows:

1) DSL Modem connected to outside interface of PIX515E. Outside interface of PIX receives IP (192.168.1.201) from modem's DHCP Server. Modem's private IP is 192.168.1.254.

2) Inside interface of PIX is connected to switch and routs off IPs 192.168.1.xxx to my private network.

My problem is that I would like to access my DSL modem's web interface from my inside network but can't with my current setup. I tried setting up a static route but I got a message from the ASDM stating "Cannot add route. Connected rout already exists".


Can anyone tell me what I am doing wrong?

Here is my running configuration:



: Saved
:
PIX Version 7.2(3)
!
hostname pixfirewall
domain-name default.domain.invalid
enable password .79Go66qBAqhH3S4 encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns domain-lookup inside
dns server-group DefaultDNS
name-server 192.168.2.254
name-server 192.168.1.1
domain-name default.domain.invalid
access-list RemoteUsers_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.128
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool RemoteClientPool 192.168.2.50-192.168.2.100 mask 255.255.255.0
no failover
monitor-interface outside
monitor-interface inside
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm
no asdm history enable
arp timeout 14400
nat-control
global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0 dns
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcp-client client-id interface outside
dhcpd address 192.168.1.150-192.168.1.254 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy RemoteUsers internal
group-policy RemoteUsers attributes
dns-server value 192.168.1.3 192.168.2.254
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RemoteUsers_splitTunnelAcl
username Extension password aVn0wgo4Di61tCCd encrypted privilege 0
username Extension attributes
vpn-group-policy RemoteUsers
tunnel-group RemoteUsers type ipsec-ra
tunnel-group RemoteUsers general-attributes
address-pool RemoteClientPool
default-group-policy RemoteUsers
tunnel-group RemoteUsers ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:949fef4baeef2edab68d072676c498c8
: end
asdm image flash:/asdm
no asdm history enable

 

[LarryTheCucumber]

You shouldn't have the internal network the same as the outside network. It doesn't work. The best thing to do is change your internal to some other addresses, 192.16.2.x or
set the third octet(2)even higher.

 

[marflo500]

Sorry LarryTheCucumber but I made a mistake in my last post. The third octet of the outside IP is 2 not 1. The post should have read:

1) DSL Modem connected to outside interface of PIX515E. Outside interface of PIX receives IP (192.168.2.201) from modem's DHCP Server. Modem's private IP is 192.168.2.254.

Hope this helps.

Liam

 

[NetworkGhost]

The problem is that the modem does not no how to get to the client because you are bypassing nat. Take out this line:

no nat (inside) 0 access-list inside_nat0_outbound

http://www.wr-mem.com

 

[marflo500]

Thanks again NetworkGhost but the problem existed before that line was created. That line is only there to allow VPN clients to bypass NAT.

Any other ideas?

Liam

 

[NetworkGhost]

I see that it was for bypassing nat. The modem most likely does not have a route to the 192.168.1.x network. Correct me if it does. If you are bypassing nat your inside addresses will not be translated to the outside interface as you have it setup.

The modem would then not be able to send a reply packet to the correct next hop because it doesnt know where the 192.168.1.x network is.

Does that make sense? Do you have a route programmed on the MODEM?

From the ASA, can you ping the modem?

http://www.wr-mem.com

 

[marflo500]

No I do not have a route to the 192.168.1.x network programmed on the modem. Would I also need that along with the route to the 192.168.2.x on the PIX?

And no, I cannot ping the modem from the ASA.

Liam

 

[NetworkGhost]

Can you confirm what the modems IP was? Either you would need a route or take out nat bypass and let the traffic get pat'd to the interface.

http://www.wr-mem.com

 

[marflo500]

The modem's IP is 192.168.2.254.

 

[NetworkGhost]

Did you take out the nat bypass statements?

http://www.wr-mem.com

 

[marflo500]

Yes I took it out. This is my running configuration now:

: Saved
:
PIX Version 7.2(3)
!
hostname pixfirewall
domain-name default.domain.invalid
enable password .79Go66qBAqhH3S4 encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns domain-lookup inside
dns server-group DefaultDNS
name-server 192.168.2.254
name-server 192.168.1.1
domain-name default.domain.invalid
access-list RemoteUsers_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool RemoteClientPool 192.168.2.50-192.168.2.100 mask 255.255.255.0
no failover
monitor-interface outside
monitor-interface inside
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm
no asdm history enable
arp timeout 14400
nat-control
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0 dns
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no sysopt connection permit-vpn
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcp-client client-id interface outside
dhcpd address 192.168.1.150-192.168.1.254 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy RemoteUsers internal
group-policy RemoteUsers attributes
dns-server value 192.168.1.3 192.168.2.254
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RemoteUsers_splitTunnelAcl
username Extension password aVn0wgo4Di61tCCd encrypted privilege 0
username Extension attributes
vpn-group-policy RemoteUsers
tunnel-group RemoteUsers type ipsec-ra
tunnel-group RemoteUsers general-attributes
address-pool RemoteClientPool
default-group-policy RemoteUsers
tunnel-group RemoteUsers ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:30a6047ceebff3c0028f45ed56cda0d6
: end
asdm image flash:/asdm
no asdm history enable


Should I make the routes on the modem and the firewall?

Liam