Pix Firewall passing traffice but not resolving DNS

[slwilson]

I am configuring a CISCO PIX 506 and have a network with a /27 group of IPs that needs to be NATed back to their private network. When I hook my laptop on to the internal network behind the firewall with a private IP, I am able to ping outside IP addresses but not able to resolve DNS. DNS servers are outside of the network and are part of the ISP. Once I can resolve the DNS issue, there will be 3 servers on the internal network that will need static routes (web, smtp, and terminal services). Please help if possible. Here is the config as it is now.

pixfw.vfb# show config
: Saved
: Written by enable_15 at 00:28:21.887 UTC Tue Jan 7 2003
PIX Version 6.2(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password X828ig0c4vWdZ4bn encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfw.vfb
domain-name xx
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
logging on
interface ethernet0 10baset
interface ethernet1 10baset
mtu outside 1500
mtu inside 1500
ip address outside 68.xx.xx.100 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 68.xx.xx.101-68.xx.xx.126
global (outside) 1 68.xx.xx.98
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 68.xx.xx.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 10
ssh timeout 5
terminal width 80

Thanks

 

[AlvaroMuir]

I dont see any access list. Probaby by default all udp are blocked>? I would add some access lists.
First,
access-list outbound permit ip any any
access-list inbound permit icmp any any
access-list inbound deny ip any any
access-group outbound in interface inside
access-group inbound in interface outside

when ur done testing, you could get rid of the icmp if you want

Hope this helps,

- alvaro

 

[routerman]

If I understand your question, are you saying you want to access your Internal servers by using an external DNS?

If so you will need to use the alias command to translate the outside address in the DNS reply to the internal server address.

Your outgoing connections and the corresponding replies will be allowed by your existinf PIX config, they will use a source IP address defined in your global statement.

 

[slwilson]

worked great alvaromuir. Thanks for your help.

 

[havanajoe]

It is not a good idea to have access-list inbound permit icmp any any. This will allow anyone external to ping ANYTHING on the internal network.

If you want to be able to ping from the internal network to the internet and get a response you will need to change the ACL to read...

access-list inbound permit icmp any echo-reply
access-list inbound permit icmp any time-exceeded

This will let echo packet out and the reply back in.

 

[slwilson]

Thanks for all your help. Have removed the icmp any any access-list. I am working on setting up the filtering server with N2H2 now for this network. If I have any more problems I will definitely know where to post it. Thanks again.