Issues with Inbound Access on 501

[Jeromy113]

I created the ACL and the Static route and when I do a DNS check, it can access the web server and bring back a sample text page (i.e. Check-DNS). Well when I try to get to my web page from my internal, I still get nothing (403 error). Checking the logs the only thing I see is the following when I try to access this page, this doesn't log when I surf normally.

<163>:%PIX-3-106011: Deny inbound (No xlate) icmp src outside:xxx.xxx.135.74 dst outside:xxx.xxx.48.133 (type 8, code 0)

<163>:%PIX-3-106011: Deny inbound (No xlate) icmp src outside:xxx.xx.54.153 dst outside:xxx.xx.33.133 (type 8, code 0)

Etc, etc. Another thing, these IPs don't match anything, I'm guessing they are from the ISP.

Could these errors be the source of my issues and how would I fix this?

 

[swj38]

This shouldn't be the cause of your problem, the logs are for ping traffic (icmp type 8, code 0 is an echo reply). What this traffic looks like is ping traffic trying to use your pix like a router it's coming in from an outside address destined for another outside address, the (No xlate) message is because the pix won't translate a packet address and send it back out of the interface it came in on.

Best guess as to what's causing this is that the router in front of your Pix thinks that there's a route to the internet on the interface that your Pix is on and is routing stuff to you, though this is just a guess.

As for the DNS issue, can't really tell with the info you've given. Where is the Web server (DMZ?) and which segments can/can't reach it? If your not seeing anything in the logs you might need to up the logging level.

Hope this helps.

Steve

 

[Jeromy113]

The web server is internal, not on a DMZ (Pix 501). To host a web server inside the Pix, the only ports that need to be open to allow access from outside to inside, is port 80, correct? Is there anything else I'm missing? Here are the commands I used to route port 80...

access-list 100 permit tcp any host XXX.XXX.XXX.XXX eq www

static (inside,outside)tcp interface

http://www xxx.xxx.xxx.xxx

http://www netmask

255.255.255.255 0 0

access-group 100 in interface outside

I'm troubleshooting between this Pix and the ISP changing my static on me, it's not fun, but I'm learning alot.

I just want to get my web server up and running before I hit my exchange and other services server. Thanks.

 

[dx1]

Are you trying to get to your web server by it's FQDN, external IP address or internal ip address? If your trying by FQDN or ext address, it's not going to work unless you have some sort of alias setup on the PIX or an internal DNS that resolves your domain name to the internal address.

 

[Jeromy113]

I'm using the FQDN of the server and the pix is supposed to translate that using PAT to the server on the internal network..example

http://www.whatever.com

-> 210.111.111.111 (example external) ->
Pix -> 192.168.1.1 (Example internal)

It worked fine using Linksys or SMC router by just doing a port redirect.

 

[Jeromy113]

One more thing I found that might explain my issue..there is a troubleshooting page from Cisco about slow or intermittent performance for FTP/HTTP and they suggested for a fix to setup PTR records in DNS for the IPs in the internal global pool. I'm using PAT, but I have no PTR records on my internal DNS. Whould this help, I'm at work so I cannot try untill later tonight. Thanks.

 

[Jeromy113]

Here is the update. I can access all the services that I could before, i.e. Web/exchange/etc. But, I cannot use these services using FQDM from the internal network. Here is my config...

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password lbFr7vIjWUMOkZqW encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
object-group service Lease-WebPorts tcp
description Ports for Lease-Web, execpt for MOM 1270
port-object eq ftp
port-object eq pop3
port-object eq ftp-data
port-object eq https
port-object eq smtp
access-list 100 permit tcp any interface outside eq www
access-list 100 permit tcp any host 216.15.33.140 object-group Lease-WebPorts
access-list 100 permit tcp any host 216.15.33.140 eq 1270
access-list inside_outbound_nat0_acl permit ip any 192.168.1.168 255.255.255.248
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.168 255.255.255.248
pager lines 24
logging on
logging monitor debugging
logging trap notifications
logging host inside 192.168.1.150 format emblem
icmp permit any echo-reply inside
icmp permit any unreachable inside
icmp permit any time-exceeded inside
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute retry 4
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool Lease_VPN_Pool 192.168.1.170-192.168.1.172
pdm location 192.168.1.160 255.255.255.255 inside
pdm location 192.168.1.150 255.255.255.255 inside
pdm logging debugging 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp xxx.xxx.xxx.140

http://www 192.168.1.160

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 ftp 192.168.1.160 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 ftp-data 192.168.1.160 ftp-data netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 smtp 192.168.1.160 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 pop3 192.168.1.160 pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 https 192.168.1.160 https netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 995 192.168.1.160 995 netmask 255.255.255.255 0 0
static (inside,outside) tcp xxx.xxx.xxx.140 1270 192.168.1.160 1270 netmask 255.255.255.255 0 0
access-group 100 in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 192.168.1.160 timeout 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup Lease_Users address-pool Lease_VPN_Pool
vpngroup Lease_Users dns-server 192.168.1.112
vpngroup Lease_Users default-domain lease
vpngroup Lease_Users idle-time 1800
vpngroup Lease_Users password ********
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:eec8a7ad1b899c680a7eebb0089af3f8

Is there something I'm missing? I am real new to the cisco and firewall environment. Thanks all.