Network Changes causing problems

[mot98]

Hi all,

We run a NT domain here, with a PIX 515 firewall. On our shop floor we did not want anyone getting access to the internet, so we made an access-list on the PIX to deny them access. The list was as follows:

access-list acl_out deny ip 192.168.50.200 255.255.255.248 any
access-list acl_out deny ip 192.168.50.208 255.255.255.248 any
access-list acl_out deny ip 192.168.50.216 255.255.255.252 any
access-list acl_out deny ip host 192.168.50.220 any
access-list acl_out permit ip any any


This worked fine.

However, last week we setup a VPN connection to another location using a DSL connection. To complete this process we installed a new Router that became our new Default Gateway for the network.

Once we did this, all of the shop floor computers started having problems. For some reason they could not resolve netbios names, but we could ping by IP addresses.

After determining that it was only these select computers that were having the problem, I removed the access-list on the PIX to see if it would solve the problem, which it did.

However, I need to find out why this happened, and to start blocking these systems again.

Any thoughts on why this happened?

Thanks...

mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[dx1]

On this new router that is the default gateway, does it have a default route to the PIX?

 

[mot98]

I checked out the config on the new router...

It does have a default route to the PIX.

mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[baddos]

We need to know what subnets you have, what routers are routing them, and where your dns servers and dns clients are located.

 

[mot98]

My subnet is 192.168.50.0

My routers and DNS are as follows

Cisco Router 192.168.50.3
Cisco PIX 192.168.50.1
DNS Server 192.168.50.90


It seems really weird that changing the default gateway would have this effect.

mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[baddos]

The pix won't do ip redirects, so you'll have to make the cisco router be the default gateway. Then have it's default route be the pix.