Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

PIX 506E Config Help!

Status
Not open for further replies.
Mar 6, 2010
21
US
I have a PIX 506E.
My ISP assigned 11.11.11.80-87 (Not Real ip's for Security Reasons)
I have dhcp configured, but cannot access anything on the 11.11.11.x network or the internet from a PC that obtained it's Network Config via the PIX dhcp.
Everything else works correctly.
What am I missing?

Here is my PIX Config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname XXX
domain-name XXX.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq www
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq https
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq pop3
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 3389
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 26
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq smtp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq ftp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1139
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1129
access-list 101 permit icmp any any
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 554
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5004
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5005
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1024
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1025
pager lines 120
logging monitor alerts
mtu outside 1500
mtu inside 1500
ip address outside 11.11.11.80 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 11.11.11.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
route inside 11.11.11.80 255.255.255.248 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.3-192.168.1.29 inside
dhcpd dns 11.11.11.81 208.153.119.250
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
 
if you have that then pix#1 internal network, pix#2 server farm, then you can do pix#3 connection between internal and server farm.

That's the hard way though.

Brent
Systems Engineer / Consultant
CCNP, CCSP
 
internet router
|
switch
|
|
---------------------
| |
| |
PIX1 PIX2
| |
| |
internal ---PIX3--- servers

Brent
Systems Engineer / Consultant
CCNP, CCSP
 
What would the PIX config look like for Pix3?
Remember Multiple Internal Servers/Workstations on the internal side and Multiple Web Servers on the Server side.
Would you need multiple NICs in each machine?
And Hubs on each side of PIX 3?

internet router
|
switch
|
|
------------------
| |
| |
PIX1 PIX2
| |
| |
internal--Hub---PIX3---Hub--servers
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top