PIX config Issue

[lifeisgreatforme]

I have a PIX 506E.
My ISP assigned 11.11.11.80-87 (Not Real ip's for Security Reasons)
I have dhcp configured, but cannot access anything on the 11.11.11.x network or the internet from a PC that obtained it's Network Config via the PIX dhcp.
Everything else works correctly.
What am I missing?

Here is my PIX Config:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname XXX
domain-name XXX.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq domain
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq www
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq https
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq pop3
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 3389
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 26
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq smtp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq ftp
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1139
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1129
access-list 101 permit icmp any any
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1755
access-list 101 permit tcp any 11.11.11.80 255.255.255.248 eq 554
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5004
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 5005
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1024
access-list 101 permit udp any 11.11.11.80 255.255.255.248 eq 1025
pager lines 120
logging monitor alerts
mtu outside 1500
mtu inside 1500
ip address outside 11.11.11.80 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 11.11.11.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 11.11.11.0 11.11.11.0 netmask 255.255.255.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 11.11.11.1 1
route inside 11.11.11.80 255.255.255.248 192.168.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.3-192.168.1.29 inside
dhcpd dns 11.11.11.81 208.153.119.250
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

 

[burtsbees]

Post in the PIX forum. Also, maybe look at sh ip nat trans *...can the pc ping the outside interface? It's been some time since I have screwed around with a PIX...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[lifeisgreatforme]

Thanks burtsbees.
I posted in the Pix forum 4 days ago, no replys, so thought that I'd try here.
I CANNOT ping the outside interface(or anythng on the outside)from the 192.168.1.5 (dhcp)
From a pc on the 192.168.1.0(dhcp) network:
I cannot ping anything on either interface except for the 192.168.1.0 network.
Everthing from the 11.11.11.0 network works perfectly.
I read someplace that what I'm trying to do is not possible with the PIX(inside routing between 2 or more networks)

 

[burtsbees]

Can you post the result of "show ip nat trans * ?

I will post a working config soon...so you can compare.

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[lifeisgreatforme]

show ip nat trans*
gives me:
MLE(config)# show ip nat trans *
Invalid keyword: "nat"
Usage: [no] ip address <if_name> <ip_address> [<mask>]
[no] ip address <if_name> <ip_address> <mask> pppoe [setroute]
[no] ip address <if_name> dhcp [setroute] [retry <retry_cnt>]
[no] ip address <if_name> pppoe [setroute]
ip local pool <poolname> <ip1>[-<ip2>]
ip verify reverse-path interface <if_name>
ip audit {info|attack} action [alarm] [drop] [reset]
ip audit name <audit_name> {info|attack} [action [alarm] [drop] [reset]]
ip audit interface <if_name> <audit_name>
ip audit signature <sig_number> disable
show|clear ip audit count [global] [interface <interface>]
show ip [address [<if_name> [pppoe|dhcp [lease|server]]]]

 

[burtsbees]

Oh...I think it's show xlate

Sorry...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[lifeisgreatforme]

2 in use, 3 most used
Global 11.11.11.81 Local 11.11.11.81
Global 11.11.11.86 Local 11.11.11.86

 

[Cluebird]

Can you clarify why you have the static?

It looks like your static statement is overriding the nat+global. Remove the static, clear xlate, then try again.

 

[lifeisgreatforme]

When I remove the static, I lose access to the 11.11.11.80 network.

The static gives access to the servers and the ports on the 11.11.11.80 network as defined in the access-list 101.
I don't want NAT to those servers/ports. It's been configured this way for 6 years and works great.

What I am trying to achive is to gain access with the 192.168.1.0 network(dhcp) for workstations. And have access to the servers on the 11.11.11.80 network.

 

[Cluebird]

OK.You need to upgrade to a ASA so you can do same-security traffic based on your design. The PIX 506 at 6.3x doesn't support what I think you're trying to do.

 

[lifeisgreatforme]

Thanks, That is what I was afraid of.
Any recommendations?

I have an Cisco RV042 and 2 more Pix 506E's.
Can I accomplish it with those units?
Internet --> RV042 --> Pix1 --> Servers
|
Pix 2 --> Dev

 

[Cluebird]

ASA 5505 is the suggested replacement for PIX 506. But depends on what other features you need. Personally, I like 5520s but that is a lot more horsepower and $$.