Okay I've tried both of these stati

[igolo]

Okay I've tried both of these static mappings but internet users still can't access my web server. The server accessible from the inside, I have inbound and outbound traffic to my mail server and internal users have access to the internet. I've checked this site and Cisco's support but both indicate that the static commands should work.

How do I get internet users to see my web servers.

static (inside,outside) 65.105.55.213 192.168.10.2 netmask 255.255.255.255 0 0
static (inside,outside) tcp 65.105.55.213 80 192.168.10.2 80 netmask 255.255.255.255 0 0

access-list 100 permit tcp any host 65.105.55.213 eq www

 

[yizhar]

HI.

Clear the ARP cache on the router.

Make sure that the static ip does not overlap with anything else.

Verify that the ip address you are using is actualy routed to you and is not the broadcast or network address.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[igolo]

Below is a copy of my config. I ran this through cisco's config analyzer but no serious issues came back. I put the web server directly on the router with the .213 IP and the website works fine. The firewall just does not seem to allow http in. I set syslog in debug mode and this is what I got back

Built outbound TCP connection 396 for faddr 65.105.55.213/80 gaddr 65.105.55.211/1366 laddr 10.1.1.7/1228
302002: Teardown TCP connection 390 faddr 65.105.55.213/80 gaddr 65.105.55.211/1360 laddr 10.1.1.7/1223 duration 0:02:08 bytes 0 (SYN Timeout)

CONFIG
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password kXiRWD4npYO2gXTT encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname CiscoPix
domain-name mad4networks.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 100 permit icmp any any
access-list 100 permit tcp any host 65.105.55.210 eq smtp
access-list 100 permit tcp any host 65.105.55.213 eq www
access-list 100 permit tcp any host 65.105.55.210 eq www
pager lines 24
logging on
logging timestamp
logging console errors
logging buffered errors
logging trap notifications
logging host inside 10.1.40.1
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 65.105.55.211 255.255.255.248
ip address inside 10.1.1.254 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.1.1.4 255.255.255.255 inside
pdm location 10.1.1.8 255.255.255.255 inside
pdm location 10.1.1.254 255.255.255.255 inside
pdm location 10.1.40.1 255.255.255.255 inside
pdm logging notifications 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 65.105.55.210 smtp 10.1.1.4 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp 65.105.55.210

http://www 10.1.1.4

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp 65.105.55.213

http://www 10.1.40.1

http://www netmask

255.255.255.255 0 0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 65.105.55.209 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 10.1.1.254 255.255.255.255 inside
http 10.1.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 10.1.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:f7e6cf2d8834438e474471d123ed8e2e
: end
[OK]

Any help would be greatly appreciated as severe frustration has begun to set in.
Oh I'm using an SDSL connection with five routable IP's

 

[yizhar]

HI.

Once again, clear the ARP cache on the router.
It can be done from the router console/telnet, or by rebooting the router.

You should be able to ping the address 65.105.55.213 from the router and get replies from the pix.

Bye Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar