PIX 515 Setup - Can Not access our internal web server from inside

[JoeAtReveal]

We can not access our internal web server from inside our network... there is no problem accessing the web server from an outside network.

I've read the previous post about this problem, but when I put in the alias I get the following error.

Thanks
Joe B.

pixfirewall(config)# alias (inside) 10.1.1.6 216.123.228.198 255.255.255.240
Error: Non zero host number in network address 10.1.1.6
Usage: [no] alias [<(if_name)>] <dnat_ip> <foreign_ip> [<mask>]

Cisco PIX Firewall Version 6.2(1)
Cisco PIX Device Manager Version 2.0(2)

Compiled on Wed 17-Apr-02 21:18 by morlee

pixfirewall up 62 days 17 hours

Hardware: PIX-515, 64 MB RAM, CPU Pentium 200 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash AT29C257 @ 0xfffd8000, 32KB

0: ethernet0: address is 0050.54ff.4732, irq 10
1: ethernet1: address is 0050.54ff.4733, irq 7
2: ethernet2: address is 0002.b346.294c, irq 11
3: ethernet3: address is 0002.b346.295b, irq 9
Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES: Enabled
Maximum Interfaces: 6
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited

Configuration last modified by enable_15 at 13:52:58.531 UTC Tue Nov 12 2002

------------------ show config (run time) ------------------

:
PIX Version 6.2(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
nameif ethernet3 intf3 security15
enable password oR.ppHIsko.GmHYK encrypted
passwd EAozKKQULpsVcAxL encrypted
hostname pixfirewall
domain-name appas.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list acl_out permit icmp any any
access-list acl_out permit tcp any any eq www
access-list acl_out permit tcp any host 216.123.228.201 eq 81
access-list acl_out permit tcp any host 216.123.228.201 eq 8484
access-list acl_out permit tcp any any eq pcanywhere-data
access-list acl_out permit tcp any any eq 5632
access-list acl_out permit tcp any any eq 5633
access-list acl_out permit tcp any any eq 6802
access-list acl_out permit tcp any host 216.123.228.198 eq ftp-data
access-list acl_out permit tcp any host 216.123.228.198 eq ftp
access-list acl_out permit tcp any host 216.123.228.201 eq pop3
access-list acl_out permit tcp any host 216.123.228.201 eq smtp
access-list acl_out permit tcp any host 216.123.228.204 eq domain
access-list acl_out permit tcp any any eq domain
access-list acl_in permit icmp any any echo-reply
pager lines 24
logging on
logging buffered debugging
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 100full
interface ethernet3 auto shutdown
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
ip address outside 216.123.228.194 255.255.255.240
ip address inside 10.1.1.1 255.255.255.0
ip address intf2 127.0.0.1 255.255.255.255
ip address intf3 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address intf2 0.0.0.0
failover ip address intf3 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 216.123.228.195-216.123.228.207 netmask 255.255.255.240
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
alias (inside) 206.251.29.10 216.22.214.122 255.255.255.255
static (inside,outside) 216.123.228.197 10.1.1.5 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.198 10.1.1.6 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.200 10.1.1.8 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.201 10.1.1.9 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.199 10.1.1.7 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.195 10.1.1.3 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.204 10.1.1.12 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.203 10.1.1.11 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.202 10.1.1.10 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.205 10.1.1.13 netmask 255.255.255.255 0 0
static (inside,outside) 216.123.228.206 10.1.1.14 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 216.123.228.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
terminal width 80

 

[sunyasee]

Try adding the command as....

pixfirewall(config)# alias (inside) 10.1.1.6 216.123.228.198 255.255.255.255

I think your subnet mask was wrong as you are only specifying one host. With the mask 255.255.255.240 the pix thinks you are trying to create an alias for the entire subnet??

----

Sunyasee B-)