PIX501 & D-Link DSL504 Modem

[lightprof]

HELP!!!!!

Forgive me I am a Newbie to firewalls and Cisco Pixs.

I am having a major nightmare trying to configure my PIX501 on our small office network. I currently connect to a BT Openworld via a D-Link DSL504 Router. I can successfully browse the internet from a network client using the network without the PIX but when I place the PIX between the hub and the DSL504 I can not browse the net.

My client PC has the following settings in the network properties “Internet Protocol (TCP/IP)”

IP Address (Manually configured on each PC) 192.168.0.xxx
Subnet mask 255.255.255.0
Default Gateway (Network Ethernet address of the DSL504) 192.168.0.250

The admin software built into the DSL504 has all the correct settings to dial into the BT account and picks up our static IP address provided to us by BT.

And this works fine without the pix.

When I connect the pix it all stops working I have a patch cable connecting the pix to the network and the yellow cable supplied by Cisco connecting the pix to the DS504. I have read that I you should use a crossover cable to connect to a DSL modem but when I use the (orange cable) I do not get the link light, so I therefore use the yellow (patch cable). The settings for the pix are below

pixfirewall# show config
: Saved
: Written by enable_15 at 09:01:29.961 UTC Fri Apr 25 2003
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list inside_access_in permit tcp host 192.168.1.7 host 198.168.0.250
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 198.168.0.250 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.7 255.255.255.255 inside
pdm location 192.168.1.7 255.255.255.255 inside
pdm location 192.168.0.250 255.255.255.255 outside
pdm location 217.34.44.86 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.0.7 255.255.255.255 inside
http 192.168.1.7 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:85b213c893330f415c990995b9e736c7


The outside address is the same as the DSL504 network address is this correct

Any help in this matter would be very much appreciated as I am loosing hair over this

Cheers

Lightprof

 

[havanajoe]

The problem that I see with the config is that your access-list only allows the host 192.168.1.7 to go to host 198.168.0.250. All other traffic is dropped going outbound.

access-list inside_access_in permit tcp host 192.168.1.7 host 198.168.0.250

access-group inside_access_in in interface inside


Try removing the access-group statement and do a clear xlate and then try to get out. For a quick test I would add the following statement (just for testing purposes only though)

access-list inside_access-in permit icmp any any
access-group inside_access_in in interface inside
access-group inside_access_in in interface outside

This will allow icmp (pings) to be able to go in and out of the pix for testing. Once you have confirmed connectivity remove the access-list and it will remove both access-list and access-grup.

 

[yizhar]

HI.

> ip address outside 198.168.0.250 255.255.255.0
> The outside address is the same as the DSL504 network address is this correct?
No.
It must be something else, like 192.168.0.1

> nat (inside) 0 0.0.0.0 0.0.0.0 0 0
This should be changed to:
no nat (inside) 0 0.0.0.0 0.0.0.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

> access-list inside_access_in permit tcp host 192.168.1.7 host 198.168.0.250
You won't get far with such ACL. Remove the ACL first and then check connectivity.

Read the pix 501 - there is an option to reset and go back to factory default config, which will then work for you as a better starting point.

The internal workstations should be reconfigured for automatic ip addressing (DHCP), and you should deploy the DNS servers addresses using DHCP.

A better solution is to use PPPoE - with this option you remove the DSL router from the network and place a very generic modem instead, and then the pix "dials" the ISP and not the modem. Ask your ISP about that option.
The current sceanrio of 2 devices with NAT (both the pix and the router) is not recommended and will cause problems.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar