PIX 506E Config Help!

lifeisgreatforme · Mar 18, 2010

I have a PIX 506E.
My ISP assigned 11.11.11.80-87 (Not Real ip's for Security Reasons)
I have dhcp configured, but cannot access anything on the 11.11.11.x network or the internet from a PC that obtained it's Network Config via the PIX dhcp.
Everything else works correctly.
What am I missing?

Here is my PIX Config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname XXX
domain-name XXX.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq www
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq https
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq pop3
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 3389
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 26
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq smtp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq ftp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1139
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1129
access-list 101 permit icmp any any
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 554
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5004
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5005
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1024
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1025
pager lines 120
logging monitor alerts
mtu outside 1500
mtu inside 1500
ip address outside 11.11.11.80 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 11.11.11.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
route inside 11.11.11.80 255.255.255.248 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.3-192.168.1.29 inside
dhcpd dns 11.11.11.81 208.153.119.250
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

Viconsul · Mar 24, 2010

Hello,
Try this config, pay attention to the highlighted commands.

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname XXX
domain-name XXX.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq www
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq https
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq pop3
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 3389
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 26
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq smtp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq ftp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1139
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1129
access-list 101 permit icmp any any
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 554
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5004
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5005
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1024
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1025
access-list 102 permit tcp any 192.168.1.0 255.255.255.0 eq www ;Permits your internal lan to access internet you can add more ports
access-list 102 permit tcp any 192.168.1.0 255.255.255.0 eq https
access-list 102 deny ip any any
access-list 102 deny tcp any any
access-list 102 deny udp any any
pager lines 120
logging monitor alerts
mtu outside 1500
mtu inside 1500
ip address outside 11.11.11.80 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 11.11.11.0 255.255.255.248 outside ;Allows management of pix via pdm from external NOT ADVISABLE.
pdm location 192.168.1.0 255.255.255.0 inside ;Allows you to manage your pix via pdm from your internal hosts.
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 11.11.11.80

http://www 192.168.1.10

http://www netmask

255.255.255.0 0 0 ;This is pointing your external ip of 11.11.11.80 to your internal webserver on 192.168.1.10
access-group 101 in interface outside
access-group 102 in interface inside
route outside 0.0.0.0 0.0.0.0 11.11.11.80 1
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.3-192.168.1.29 inside
dhcpd dns 11.11.11.81 208.153.119.250
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

Supergrrover · Mar 24, 2010

route outside 0.0.0.0 0.0.0.0 11.11.11.80 1
should point to the gateway from your ISP not the pix itself.

Get rid of the inside acl. You don't need it and it isn't set up correctly
access-group 102 in interface inside

Brent
Systems Engineer / Consultant
CCNP, CCSP

lifeisgreatforme · Mar 25, 2010

So the line
route outside 0.0.0.0 0.0.0.0 11.11.11.80 1
should read
route outside 0.0.0.0 0.0.0.0 11.11.11.1 1

and remove ALL of the Access-list 102 config that viconsul added?

lifeisgreatforme · Mar 25, 2010

Did all of that and still cannot access the internet or computers on the 11.11.11.0 network from 192.168.1.2 computer.

When try to add the
route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
I get
Route already exists

unclerico · Mar 25, 2010

1) post a new scrubbed config
2) the fact that your address space is 11.11.11.80/29 and you post a next hop of 11.11.11.1 is confusing. did you get a /29?? if so post back with the first three octets of your address range changed, but use the real host addresses so we can make sure you have the proper addressing applied

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

lifeisgreatforme · Mar 25, 2010

My ISP gave me 11.11.11.80-87 (the 11.11.11. are not the real #'s but everthing else is)

Here is the new scrubbed config:

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname ABC123
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq www
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq https
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 3389
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 26
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq smtp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq ftp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1139
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1129
access-list 101 permit icmp any any
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 554
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5004
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5005
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1024
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1025
pager lines 200
mtu outside 1500
mtu inside 1500
ip address outside 11.11.11.80 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.1.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
static (inside,outside) 11.11.11.0 192.168.1.0 netmask 255.255.255.255 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
route inside 11.11.11.80 255.255.255.248 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd dns 11.11.11.81
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

lifeisgreatforme · Mar 25, 2010

The ISP gave me the 11.11.11.1 as the gateway

unclerico · Mar 26, 2010

from the PIX can you ping 4.2.2.2??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

Supergrrover · Mar 27, 2010

Get rid of these too

static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
static (inside,outside) 11.11.11.0 192.168.1.0 netmask 255.255.255.255 0 0

Brent
Systems Engineer / Consultant
CCNP, CCSP

lifeisgreatforme · Mar 28, 2010

Supergrrover,
That gives me internet access from 192.168.1.3-254(dhcp addresses) and 11.11.11.80-87.
But I need acccess to 11.11.11.80-87 from 192.168.1.3-254(dhcp). How do I accomplish that?

lifeisgreatforme · Mar 28, 2010

I need the:
static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
to allow internet access to the 11.11.11.81-87 Server addresses.
But that breaks the internet access for the 192.168.1.3-254(dhcp) addresses.

Supergrrover · Mar 28, 2010

Can you post a physical and logical topography?

Brent
Systems Engineer / Consultant
CCNP, CCSP

lifeisgreatforme · Mar 29, 2010

Sure, Here it is.

http://www.mediafire.com/file/ndncjotccmw/RV042_2-Pix_Generic-forum.jpg

lifeisgreatforme · Mar 29, 2010

Here is the corrected one.

http://www.mediafire.com/file/ndncjotccmw/RV042_2-Pix_Generic-forum.jpg

lifeisgreatforme · Mar 29, 2010

Let's this again Try again.

http://www.mediafire.com/?4mlwkoqainw

Supergrrover · Mar 29, 2010

I get it now. The pix doesn't work that way. You need to give the servers private IPs and map those through statics to the public IPs that are handled by the pix.

Take a look at this

http://www.cisco.com/en/US/products...s_configuration_example09186a0080094466.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

lifeisgreatforme · Mar 30, 2010

What product will do what I need it to do?

Supergrrover · Mar 31, 2010

Why do you have public IPs on your private internal network? Give them private IPs and and map them with statics and secure them with access lists like in the example.

You can get a separate ASA and have it setup for transparent firewall.

Brent
Systems Engineer / Consultant
CCNP, CCSP

lifeisgreatforme · Apr 1, 2010

That's what I'm doing with the PIX(Transparent FireWall).
But I'm trying to incorporate a private(corp. Lan) on the same PIX, which I have learned is IMPOSSIBLE to do both.
So now I have to buy more Equipment to accomplish what I thought would be a simple task.
I have a Cisco RV042 and 3 Pix 506e's can it be done with those? or do I need an ASA to do what I want?

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

PIX 506E Config Help!

MIS

Technical User

IS-IT--Management

MIS

MIS

IS-IT--Management

MIS

MIS

IS-IT--Management

IS-IT--Management

MIS

MIS

IS-IT--Management

MIS

MIS

MIS

IS-IT--Management

MIS

IS-IT--Management

MIS

Similar threads

Log in

Part and Inventory Search

Sponsor