New Config Problem on 515

[CMASPE]

Ok guys I got the PIX reconfigured but am perplexed at what is wrong with my internal network getting "out" to the world. I am running a 3 interface setup with No nat. I put in the Nat 0 command for my internal network but can not break free. If I enter a static command I have full access out. I don't mind putting in the static commands but why do I have to do that???? Also a few of you gave me some helpful tips after my last config fiasco and was wondering your opinion on the new one.
Config Below:
PIX Version 5.2(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security40
enable password KD5yTHD9ywYo32ZI encrypted
passwd b6ZsBGZIV.tPUUgC encrypted
hostname XXXX
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
no names
access-list outside permit tcp any host XX.XX.XX.5 eq smtp
access-list outside permit tcp any host XX.XX.XX.6 eq smtp
access-list outside permit tcp any host XX.XX.XX.3 eq smtp
access-list outside permit udp any host XX.XX.XX.3 eq domain
access-list outside permit udp any host XX.XX.XX.2 eq domain
access-list outside permit tcp any host XX.XX.XX.4 eq ftp
access-list outside permit tcp any host XX.XX.XX.4 eq www
access-list outside permit icmp any any
access-list outside permit tcp any host XX.XX.XX.13 eq www
access-list outside permit tcp any host XX.XX.XX.10 eq www
access-list outside permit tcp any host XX.XX.XX.11 eq www
ETC ETC ETC for Websites....
pager lines 24
logging on
no logging timestamp
no logging standby
no logging console
no logging monitor
no logging buffered
no logging trap
no logging history
logging facility 20
logging queue 512
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
ip address outside XX.XX.XX.XX 255.255.255.252
ip address inside XX.XX.XX.1 255.255.255.224
ip address dmz1 XX.XX.XX.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
arp timeout 14400
nat (inside) 0 XX.XX.XX.X 255.255.255.224 0 0
static (dmz1,outside) XX.XX.XX.4 XX.XX.XX.4 netmask 255.255.255.255 0 0
ETC ETC ETC for Static Statements
access-group outside in interface outside
established tcp 0 0 permitto tcp 0 permitfrom tcp 0
route outside 0.0.0.0 0.0.0.0 XX.XX.XX.XX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
no floodguard enable
no sysopt route dnat
isakmp identity hostname
telnet XX.XX.XX.XX 255.255.255.255 inside
telnet XX.XX.XX.XX 255.255.255.255 dmz1
telnet timeout 60
ssh timeout 5
terminal width 80
Cryptochecksum:b4ad98d14d8a8b69df99f684d3466de1
: end

THANKS!!!!!!!!!

 

[CMASPE]

After reading some more on Cisco's site it does appear necessary to add the range to the static route. Sorry for the ques. I was still wondering what you all think of the config? I removed the established command all together. Thoughts?

 

[yizhar]

HI.

I think that nat 0 should be enough to get out, and if it doesn't, it might be a routing issue (check router configuration).

Can you telnet from inside to the router without static?


I also think that if you use STATIC, you can use a few statements with subnets like 255.255.255.0 for multiple hosts together. Try and See.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[CMASPE]

Yes I tried and could put in a whole static route for a subnet. Lucky me! I could not telnet into the router from the inside without a static route. I found an article on the Cisco website that had the use of nat 0 and static so I went ahead and did it..although it seems I have read elsewhere that it shouldn't require that!! Hmm. How does the rest of the config look??

 

[yizhar]

HI.

The config seems ok to me. Remove unneeded STATIC commands as I wrote before.

I suggest using PDM for access-list management.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Guest_imported]

Yizhar,

I am pretty new to PIX but I am configuring mine and I still cant seem to get to the internet through it. I can ping my network and the world when I am consoled in to the PIX, but if I am on my network I cant hit any websites. Below is my config can you let me know what I might be doing wrong.

VHPIX# sh conduit
VHPIX# sh conf
: Saved
:
PIX Version 6.0(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password vZp97qfDCBnFEO9F encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname VHPIX
domain-name xxxx.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
logging buffered debugging
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 0.0.0.10 255.255.255.192
ip address inside 0.0.0.10 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 0.0.0.11 netmask 255.255.255.192
nat (inside) 1 199.20.0.0 255.255.0.0 0 0
route outside 0.0.0.0 0.0.0.0 0.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:0be93e58e3d5aac6fa8e9e2cd8f19eaf
VHPIX#

 

[yizhar]

HI.

ip address outside 0.0.0.10 255.255.255.192
ip address inside 0.0.0.10 255.255.255.0

global (outside) 1 0.0.0.11 netmask 255.255.255.192
nat (inside) 1 199.20.0.0 255.255.0.0 0 0

Is this your real config?
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar