Newbie Help - At a customer site!! Should be an easy one!

[PixPocket]

Hey all! Just setting up my first PIX at a client site and I am having trouble getting the PIX communicating with the internet. I am attaching my config below. Please take it easy on me as I AM a newbie and I HAVE searched for the answer before posting, but to no avail. Please feel free to comment on any other areas of my config that could use some help (I'm sure there's plenty to improve upon). Anyway, on to my question:

I have a perimeter router that is commmunicating with the internet. The outside interface is configured for DHCP and the inside is 192.168.10.2. The outisde int on the PIX is 192.168.10.1. No problem I can ping the router fine. The inside int on the PIX is 192.168.1.1 and my internal nodes are all in the same subnet and use this int as their default gateway. Again, I can ping the interfaces no problem from the internal nodes. So, this leads me to believe it's just a route or possibly something with NAT that is screwy. As you can see from my config, I have been trying ANYTHING, so I just attached my latest shot in the dark. Basically trying to ping an external address from the PIX receives no response. PLEASE HELP!!!
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxx encrypted
passwd xxxxxxxx encrypted
hostname pix
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.1 255.255.255.0
ip address inside 192.168.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.1.100 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.10.2 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.1.100 255.255.255.255 inside
telnet timeout 5
ssh timeout 5

 

[PixPocket]

Anybody?!? Please help - I am on Day 2 after a very long evening!!! Still cannot access external addresses.

 

[whitesand]

What is your gateway IP (address for your router)? I believe the command: route outside 0.0.0.0 0.0.0.0 192.168.10.2 1 should point to that address.

 

[PixPocket]

Thank you for the reply! The inside interface on the router is the 192.168.10.2 and the outside is configured to pickup an address via DHCP. Are you saying to change my route statement to the outside int ip address (the DCHP address)? I was under the impression I just needed to put the next hop address in the route statement - which I thought I did (inside int ip address of router). Please advise! I certainly appreciate your help!!!

 

[whitesand]

Okay, let me get this right. Your gateway is 192.168.10.2 (router IP) and your PIX outside interface is 192.168.1.1, PIX inside is 192.168.10.1?

Your PIX outside int needs to be on the same subnet as your gateway (i.e. gateway 192.168.10.2, PIX outside int 192.168.10.4) and your PIX inside int 192.168.1.1

ip address outside 192.168.10.4 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.10.2 1

 

[sunyasee]

A few things...

ip address outside 192.168.1.1 255.255.255.0
ip address inside 192.168.10.1 255.255.255.0

shouldn't this be around the other way???

Also you'll need a route on the router advertising the 192.168.1.0 network. If you can ping the ethernet address on the router from a machine behind the PIX then I believe the problem is with the router. Is it a cisco router? If so post the config here, I'll take a look... ----

Sunyasee

 

[RJ45100BT]

You need to remember that out of the box the PIX will allow any out and nothing in.

So as long as there is an outside IP, a route to the outside and a global ip/nat statement you should be surfing. If your next hop is an internet router that is.

 

[sunyasee]

Good point RJ45100BT!!!

Add the following (for testing)...

conduit permit icmp any any

Now, can you ping the router address 192.168.10.2 from a machine inside the firewall? ----

Sunyasee

 

[PixPocket]

Thank you VERY much for the feedback everyone. I will make the suggested changes and report back on my (hopeful) success!!

PP

 

[gmanboston]

So if the perimiter router is
192.168.10.2

Firewall external should be
192.168.10.1

Firewall Internal should be
192.168.1.1

Your config in the PIX states
External is 192.168.1.1
Internal is192.168.10.1

You have your interface assignments mismatched...Reconfigure and test

 

[PixPocket]

*gulp*

Okay, okay - I feel like a HUGE heel (for lack of a better term)!!! It was as simple as that (my interface ip assignments were backwards). Can you believe that?! You're probably saying yes!!! I learned a little more about using the debugging as well, so hopefully I won't have anymore stupid questions?!?! You know how it is though, I had looked at the config a million times and it wasn't like I had never configured interfaces before. I thought I had the route correct, etc. It was all very clear when I went back (on my own time of course) and verified that the interfaces were the culprit. At the very least I would like to thank all of those that posted to help me. I truly appreciate it!!!

PP