PIX Users Cannot Access Other Websites & Email Servers on Shared T1

[picartj]

We are sharing a T1 connection with another business in our building. They have their own separate network environment from mine. I have a Windows 2003 Small Business Server behind a PIX-501 and the users in my network connect to the Internet via Windows Server’s DHCP and Internet sharing (NAT) services.

All Internet and email traffic is accessible except for those hosted by the other company who we're sharing a connection with. My users cannot access that company’s web server or send email to their email server (we all get 4.4.7 SMTP errors… days later after sending the message).

They have no firewall on their end; which is why I think there may be something wrong with my PIX configuration. I'm sort of a newbie with the PIX CLI, so any help I can get could be great. Thanks in advanced!

RSPIX# sh config
: Saved
: Written by enable_15 at 13:54:11.407 UTC Wed Jun 27 2007
PIX Version 6.3(5)
interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **** encrypted
passwd **** encrypted
hostname RSPIX
domain-name SAMPLE.COM
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit tcp any host 65.**.**.** eq smtp
access-list 101 permit tcp any host 65.**.**.** eq www
access-list 101 permit tcp any host 65.**.**.** eq https
access-list 101 permit tcp any host 65.**.**.** eq 3306
access-list 101 permit tcp any host 65.**.**.** eq ftp-data
access-list 101 permit tcp any host 65.**.**.** eq ftp
access-list nonat permit ip 10.1.0.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list 120 permit ip 10.1.0.0 255.255.255.0 172.16.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 65.**.**.** 255.255.255.224
ip address inside 10.1.0.10 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool mypool 172.16.1.1-172.16.1.254
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp 10.1.0.1 smtp netmask 255.255.255.255
0 0
static (inside,outside) tcp interface

http://www 10.1.0.1

http://www netmask

255.255.255.255 0
0
static (inside,outside) tcp interface https 10.1.0.1 https netmask 255.255.255.2
55 0 0
static (inside,outside) tcp interface 3306 10.1.0.1 3306 netmask 255.255.255.255
0 0
static (inside,outside) tcp interface ftp-data 10.1.0.22 ftp-data netmask 255.25
5.255.255 0 0
static (inside,outside) tcp interface ftp 10.1.0.22 ftp netmask 255.255.255.255
0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 65.90.**.** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 10.1.0.1 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local mypool outside
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup **** address-pool mypool
vpngroup **** dns-server 10.1.0.1
vpngroup **** default-domain SAMPLE.COM
vpngroup **** split-tunnel 120
vpngroup **** idle-time 1800
vpngroup **** password ****
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
terminal width 80
Cryptochecksum:**************************************
RSPIX#

 

[brianinms]

You will have to give us more background about how you share this connection. Is there a router that plugs into a switch and both of you plug into it?

 

[picartj]

Yes, the T1 uplink is connected to a non-managed switch. My PIX is attached to this switch as well as all the public servers for the other company. Thanks!

 

[brianinms]

So their servers have an address in the same subnet as your outside interface? If so I don't see why it doesn't work.

 

[NetworkGhost]

Are their servers dual homed? More than one NIC? Are they connected to your network in any other way? They have no firewalls? Windows2003 servers?

Can you ping?

Can you telnet to their mail server on port 25?

from windows command linexxx.xxx.xxx.xxx = mail server IP)

telnet xxx.xxx.xxx.xxx 25



Free Firewall/Network/Systems Support-

http://www.wr-mem.com

 

[picartj]

Yes, the servers are in the same subnet and I CANNOT ping any of them. Before I put the PIX in place I could access all the servers services (ftp, http, smtp, rdp, etc.).

 

[brianinms]

To ping them you have to allow ICMP back into your firewall

access-list 101 permit icmp any any echo reply

 

[picartj]

I can ping the server's IP addresses from within the PIX CLI... no problem, but I cannot ping the server's from behind the PIX (I get a 'hardware error' from within the Windows command prompt, but only when I try to ping the servers who are on the same T1 as me; I can ping google.com just fine). My Windows server is multi-homed, but only one NIC (which goes into the 4-port switch on the PIX) is connected; all other NICs are disconnected.

Brianinms, I tried your command suggestion, but no luck.