Static entry stops machine from accessing the internet!!!!

[EduardoA]

I am having a problem where I have static entries for a few machines in order to allow some users connect from home using pcAnywhere. Two of them work just fine, but there is one machine that the only way I can get it to go out on the internet is by removing the static entry or giving it a different IP address. (216.xxx.xxx.234 --> 192.168.0.2)

Here is my config:

Building configuration...
: Saved
:
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password Kgj8H0CArY1EQe85 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname PIX506E
domain-name xxx.xxx
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 115 permit icmp any any echo-reply
access-list 115 permit icmp any any time-exceeded
access-list 115 permit icmp any any unreachable
access-list 115 permit tcp any host 216.xxx.xxx.236 eq 5631
access-list 115 permit udp any host 216.xxx.xxx.236 eq 5632
access-list 115 permit tcp any host 216.xxx.xxx.235 eq 5631
access-list 115 permit udp any host 216.xxx.xxx.235 eq 5632
access-list 115 permit tcp any host 216.xxx.xxx.234 eq ftp
access-list 115 permit tcp any host 216.xxx.xxx.234 eq 5631
access-list 115 permit udp any host 216.xxx.xxx.234 eq 5632
pager lines 24
interface ethernet0 10full
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 216.xxx.xxx.69 255.255.255.0
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.10 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.0 inside
pdm location 192.168.0.2 255.255.255.255 inside
pdm location 192.168.0.3 255.255.255.255 inside
pdm location 192.168.0.4 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 216.xxx.xxx.235 192.168.0.3 netmask 255.255.255.255 0 0
static (inside,outside) 216.xxx.xxx.236 192.168.0.4 netmask 255.255.255.255 0 0
static (inside,outside) 216.xxx.xxx.234 192.168.0.2 netmask 255.255.255.255 0 0
access-group 115 in interface outside
route outside 0.0.0.0 0.0.0.0 216.39.237.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.0.10 255.255.255.255 inside
snmp-server location
snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 192.168.0.0 255.255.255.0 inside
telnet 192.168.0.10 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
dhcpd address 192.168.0.11-192.168.0.254 inside
dhcpd dns 216.xxx.xxx.2 216.xxx.xxx.3
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain inside
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:86fc58e9d97554d29eb5060bdd1a5a46
: end
[OK]


If anybody has any idea of what might be going on, please let me know..

Thanks in advance..
Eduardo

 

[jcanuk]

Do you mean giving it a different internal or external ip address? If a different external address solves the problem, then you may have an arp table issue with the isp hardware just before your pix. Consider clearing the arp tables of your switches, and also contacting your isp and requesting them to clear the arp tables.

A good way of determining if arp is really an issue is to permit all icmp through to your traget, as well as the outside interface, traceroute to the static host and see where the packets get lost. You can also issue the debug packet outside icmp command to see if the icmp packets ever reach the firewall. If they don't, it is definitely arp external, if they do, then you have another issue.

Regards,

JCanuk

 

[EduardoA]

JCanuk,

Thanks for your reply, I meant to say different internal IP. I also tried using a different outside IP, same problem. I even changed my config for this machine to use another's machine working IP, I still encountered the same issue.

I am not sure what else to try.

Eduardo

 

[yizhar]

HI

What pix device do you have?
How many licenses and how many workstations?

> I am not sure what else to try
You need to try using syslog messages.

As mentioned in previous post, it could be an ARP issue.
Reboot the router if you are not sure about this.

You need to issue this command after changing ip translation rules:
clear xlate

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[EduardoA]

Yizhar,

I have a PIX 506E running OS 6.14

I tried "clear xlate", but it didnt do anything.

Last night I changed my config again, now using port redirection with one IP. It worked last night, now this morning does not work anymore.

I will try syslog and see what I get.

Thanks,
Eduardo

 

[gbiello]

You can also try telnetting to tcp port 5631 from both and internal and external IP address and see if you get a response.

I had a similar problem trying to get PCAnywhere to work through a PIX and it was solved with a simple reboot of the PIX, as Yizhar suggested.

-gbiello

 

[yizhar]

HI Again.

You should also check for ip addressing and routing issues.
The x.x.x.234 could be a network/broadcast address at the router if it uses a different subnet mask.

Does the FTP to this address works from outside?
You can try this from the router console:
telnet 216.xxx.xxx.234 21
What do you get?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[EduardoA]

Yizhar,

What I did and it seems to be working so far, I changed my static configurations (port redirection) pointig to the PIX's outside IP and it's been running for over three ours now. Hopefully, this will not go crazy and stop working again.

To all that reply, I really appreciate your help.

Thanks,
Eduardo.