Not Able To Access WWW Servers - Config? 1

[leenetworx]

I've found myself trying to configure a couple of PIX 515s for the first time in years. I haven't done this since CONDUIT statements were in vogue so I am VERY rusty and I'm not finding the command reference very useful. After several days of trying to figure this out on my own I thought I'd post here to see if anyone could take a quick look at my config - I'd sincerely appreciate it.

I'm trying to setup a lab environment and allow access to some

http://WWW servers

on the inside network only by means of external network IPs. I have a feeling I've done something wrong in my access lists. Here's the config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password P2.5xXU2Ud1XKFIH encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pix1
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.2.2 gateway1
name 192.168.2.5 gateway3
name 192.168.2.4 gateway2
name 192.168.2.7 gateway4
access-list outside_access_in permit icmp any any
access-list outside_access_in permit tcp any eq

http://www host

192.168.3.102 eq www
access-list outside_access_in permit tcp any eq

http://www host

192.168.3.100 eq www
access-list outside_access_in permit tcp any eq

http://www host

192.168.3.101 eq www
access-list outside_access_in permit tcp any eq

http://www host

192.168.3.103 eq www
access-list inside_access_in permit tcp any eq

http://www host

192.168.3.102 eq www
access-list inside_access_in permit tcp any eq

http://www host

192.168.3.100 eq www
access-list inside_access_in permit tcp any eq

http://www host

192.168.3.101 eq www
access-list inside_access_in permit tcp any eq

http://www host

192.168.3.103 eq www
access-list inside_access_in permit tcp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.3.1 255.255.255.0
ip address inside 192.168.2.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 0.0.0.0 255.255.255.0 outside
pdm location gateway1 255.255.255.255 inside
pdm location gateway3 255.255.255.255 inside
pdm location 192.168.3.100 255.255.255.255 outside
pdm location 192.168.3.102 255.255.255.255 outside
pdm location gateway2 255.255.255.255 inside
pdm location gateway4 255.255.255.255 inside
pdm location 192.168.2.0 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 192.168.3.20-192.168.3.50 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 192.168.3.100 gateway1 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.3.102 gateway3 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.3.101 gateway2 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.3.103 gateway4 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:a9fb8c9e5bf45a0f29a289ef1c143743
: end
[OK]


Thanks so much.

 

[themut]

First, remove the ACL from the inside interface:

no access-group inside_access_in in interface inside

Then modify your current ACLs:

access-list outside_access_in permit tcp any eq

http://www host

192.168.3.102 eq www
access-list outside_access_in permit tcp any eq

http://www host

192.168.3.100 eq www
...

to:
access-list outside_access_in permit tcp any host 192.168.3.102 eq www
access-list outside_access_in permit tcp any host 192.168.3.100 eq www

You're also missing your default route:

route outside 0.0.0.0 0.0.0.0 192.168.3.X

 

[OPTIMO]

ABORT. ABORT.

 

[leenetworx]

Awesome - that was it! Guess I really butchered my access-list entries. Thanks!