Internal Users cannot reach Management Website after installing PIX

[mashadif]

Hi!

Users on the Internal network are facing problem connecting Management WebSite after installing PIX, the website is configured to allow access to only internal users when they are in office and not from the Internet.

The configuration is as given below:

Inside: 192.168.100.3
Outside: DHCP

WebServer: 192.168.100.4

I used alias command also but it seems to be not working:
Can anyone sugges the solution. Can anyone suggest the solution

PLEASE NOTE THAT THE WEBSITE IS CONFIGURE TO ALLOW ONLY INTERNAL USERS TO ACCESS THE MANAGEMENT SITE AND NOT FROM OUTSIDE WORLD.

Regards

Faheem

 

[rudeboy]

The webserver appears to be on the same subnet as the rest of your internal LAN per the info you supplied. Please explain your network layout. How did your users access this server prior to the PIX? Are they using IP or FQDN? Do you have an internal DNS server?

 

[mashadif]

Hi! rudeboy

Thanks for the reply.

My network is as given below:

Inside: 192.168.100.3
Outside: DHCP

ISA Server: 192.168.100.4
Management Server: 10.0.32.139
Internal Users: Automatic IP from DHCP Server 10.0.0.0 /16
Internal DNS Server: 10.0.1.2 and 10.0.8.7
(earlier to PIX Webserver was used with FQDN)

The connection is as given below:

Internal Users ---> ISA Server ---> PIX ---> Internet

ISA Server has 2 Interface One connected to PIX and another connected to Internal LAN (10.0.0.0).

Please suggest the solution

Regards
Faheem

 

[rudeboy]

I am a little puzzled. When your users attempt to access your management server by FQDN, the request should go to your internal DNS server (if the PC'S are correctly pointed to that). Your DNS server should answer with the IP 10.0.32.139. This IP is on your internal network, so the traffic should never leave your LAN (it will never go past your ISA server). Does your internal DNS servers have the correct records for the management server? Test your setup by doing an NSLOOKUP from a user's PC. Is the correct IP coming back for your management server? Can you ping this IP?