PIX 515E - can't get out to the internet from inside 1

[jacare]

This is very weird, CISCO could not figure it out yet.

I am using PIX 6.2(2) and PDM 2.1(1).

1-VPN from outside to inside works fine
2-Traffic between DMZ and outside works fine

PROBLEM: Can't get out to the internet from inside interface.

For what I've read, this is all that is required to allow users in the inside network to access the outside network:

//// using PAT)
global (outside) 1 63.137.81.154
nat (inside) 1 0 0
route outside 0.0.0.0 0.0.0.0 63.137.81.153 1
ip address outside 63.137.81.156
ip address inside 192.168.1.3

log entry:
106011: Deny inbound (No xlate) udp src outside:192.168.1.201/2178 dst outside:10.10.10.8/53

I appreciate your help.

P.S. PDM 2.1(1) has a great wizard for VPN, but does not parse the GLOBAL command.

 

[themut]

If you try to use the interface for PAT instead, do you have Internet access? If PAT to the interface works, try adding a static route for 63.137.81.154 onyour outside router pointing back to the PIX.

 

[predragd]

Try to add:
route inside 192.168.1.0 255.255.255.0 your_lan_router

 

[havanajoe]

The first thing that I question is where is 10.10.10.8 coming from? That is a private non-routable subnet. If you could post your config it would help.

Dave

 

[jacare]

Thanks for the tips folks. I added the interface for PAT as suggested by "themut" and it started working. I finally realized that the ARP cache of the router that the outside interface that it is connected to (63.137.81.153) was dirty and it had 63.137.81.154 associated with another MAC address. Cache flushed and all resolved.