Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Outside public IP blocked by LAN inside

Status
Not open for further replies.
IRLASCHU

IRLASCHU

IS-IT--Management
Dec 29, 2007
28
GB
Hi everyone,

I've installed a new PIX 504E firewall on one of our office that runs also a VPN Tunnel to the main office. On this site we have a backup email MTA(Sendmail) running.
Since I have setup new PIX 506E, the sendmail can receive but not send any more. My investigation shows that, from inside the network (LAN), I can no longer access our very own network using our public IP address, a simple thing as to Telnet EMAIL-Server-publin IP 25 fails, from external it works perfectly. I'm don't know here what I need to ajust, but I would imagen that I need to have the firewall allow from the LAN to access itself using the /28 IP range?

Any advise here?

<config>
PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXX encrypted
passwd XXXXXXXXXXX encrypted
hostname HOSTNAME
domain-name DOMAIN.NAME
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 1:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name EXTERNAL IP Cisco506E
name 172.16.0.1 GARFIELD
name 172.16.0.7 C2MTA
name 172.16.0.2 SRVDUB002
name EXTERNAL IP FSLOfficeNet
name EXTERNAL IP FSLDCNet
name EXTERNAL IP FSLOfficeNetNew
name EXTERNAL IP FSLDCNet2
name 172.16.0.10 HPServer01
object-group service C2MTASVCGRP tcp
port-object eq 465
port-object eq www
port-object eq https
port-object eq smtp
object-group network FSLNetworks
network-object FSLOfficeNet 255.255.255.255
network-object FSLDCNet 255.255.255.255
network-object FSLOfficeNetNew 255.255.255.255
network-object FSLDCNet2 255.255.255.255
object-group service HPSRVGRP tcp
port-object eq www
port-object eq ssh
port-object eq https
access-list inbound permit tcp any host EXTERNAL IP object-group C2MTASVCGRP
access-list inbound permit ip object-group FSLNetworks EXTERNAL IP 255.255.254.0
access-list inbound permit tcp any host Cisco506E eq www
access-list inbound permit udp any host Cisco506E eq 4500
access-list inbound permit esp any host Cisco506E
access-list inbound permit tcp any host EXTERNAL IP object-group HPSRVGRP
access-list inbound deny ip any any
access-list inside_outbound_nat0_acl permit ip 172.16.0.0 255.255.254.0 172.16.2.0 255.255.254.0
access-list outside_cryptomap_20 permit ip 172.16.0.0 255.255.254.0 172.16.2.0 255.255.254.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside Cisco506E 255.255.255.248
ip address inside 172.16.0.254 255.255.254.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
pdm location GARFIELD 255.255.255.255 inside
pdm location SRVDUB002 255.255.255.255 inside
pdm location C2MTA 255.255.255.255 inside
pdm location 172.16.2.0 255.255.254.0 outside
pdm location FSLOfficeNet 255.255.255.255 outside
pdm location FSLDCNet 255.255.255.255 outside
pdm location FSLOfficeNetNew 255.255.255.255 outside
pdm location FSLDCNet2 255.255.255.255 outside
pdm location EXTERNAL IP 255.255.255.128 outside
pdm location 172.16.1.0 255.255.255.0 inside
pdm location HPServer01 255.255.255.255 inside
pdm location 172.16.0.0 255.255.255.0 inside
pdm group FSLNetworks outside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 172.16.1.0 255.255.255.0 0 0
static (inside,outside) EXTERNAL IP GARFIELD netmask 255.255.255.255 0 0
static (inside,outside) EXTERNAL IP SRVDUB002 netmask 255.255.255.255 0 0
static (inside,outside) EXTERNAL IP C2MTA netmask 255.255.255.255 0 0
static (inside,outside) EXTERNAL IP HPServer01 netmask 255.255.255.255 0 0
access-group inbound in interface outside
route outside 0.0.0.0 0.0.0.0 EXTERNAL IP 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
ntp server EXTRENAL IP source outside prefer
http server enable
http FSLOfficeNet 255.255.255.255 outside
http FSLOfficeNetNew 255.255.255.255 outside
http EXTERNAL IP 255.255.255.128 outside
http 172.16.0.0 255.255.254.0 inside
snmp-server host inside XXXXXXXXX
snmp-server location XXXXXXXXX
snmp-server contact XXXXXXXXX
snmp-server community XXXXXXXXX
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer EXTERNAL IP
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address EXTERNAL IP netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 28800
telnet 172.16.0.0 255.255.254.0 inside
telnet timeout 60
ssh FSLOfficeNet 255.255.255.255 outside
ssh FSLDCNet 255.255.255.255 outside
ssh FSLDCNet2 255.255.255.255 outside
ssh FSLOfficeNetNew 255.255.255.255 outside
ssh EXTERNAL IP 255.255.255.128 outside
ssh 172.16.0.0 255.255.254.0 inside
ssh timeout 60
management-access inside
console timeout 60
terminal width 80
<end config>

**EXTERNAL IP = Public address removed.

Thanks,
Alexander
 
Sort by date Sort by votes
Thanks for that! This has resolved by issue.

Alexander
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Sameer258
  • Locked
  • Question
Need Help to Find ip and mac address with email who one open my email
Replies
0
Views
318
Sameer258
Sameer258
XLNTech1
  • Locked
  • Question
iptables port forwarding
Replies
0
Views
280
XLNTech1
XLNTech1
Sparrow4
  • Locked
  • Question
Configure Avaya IPO R11 / VM Pro + Office365 or Exchange for voicemail to email
Replies
2
Views
333
Johnkite
Johnkite
sudhakar346
  • Locked
  • Question
Cisco ASA inside to DMZ issue over public IP
Replies
2
Views
112
kythri
kythri
kythri
  • Locked
  • Question
Restrict access to SSL VPN by IP (ASA 5540 - 8.4(7))
Replies
0
Views
83
kythri
kythri

Part and Inventory Search

Sponsor

Back
Top