Internal website through PIX 515E

[andy]

I recently became the network administrator for a small local government entity. I have been thrust into the world of CISCO which is fine but I have a lot to learn. I have a CISCO PIX 515E firewall and I need to configure it so that when a link on the website(hosted outside the company) is clicked, it will point to a GIS server running apache inside our network. I have absolutely no idea how to do this in the CLI. I'm sorry if I'm asking too much here but any help would be appreciated. The apache server works internally so at least that much is set up correctly. I just need the general public to be able to access it from the outside.

[andy]

yes

EDIT: This is a duplicate entry...please disregard.

[acomiskey]

Have you tried write mem and rebooting?

Post a thread over in the Firewall forum with your config, that may help.

[acomiskey]

^

[andy]

Every time I changed something in the config I did the write memory and reload commands. I'll try there. thanks for letting me pick your brain all day :)

[andy]

actually...that did it, man. I just tested it from an external ip and it worked. I just can't hit the external IP from an internal IP. thank you so very much.

[acomiskey]

Ha, I think a rating is deserved after all that. Anyway, let me know if you want to work out the other problem. Enjoy.

[andy]

other problem? I could care less if they can't hit the external IP from inside the network. It's for the public to be able to access the most updated maps of our area through our 911 service. Unless there's another issue that I'm forgetting, everyone can just hit the local IP from inside the network if they want to see it.

Thanks again.

[scottmac]

This would not be a PIX thing; it would be a DNS thing.

You need an internal DNS with the domain names resolving to your internal addresses. This has to be configured as the first DNS on the client.

The links/URLs on your website must be domain names, not IP addresses ... or if you're using a dynamic web, the script language should query the client's environment and determine if it's inside or outside and send the appropriate address.

So, from the inside, when the client browser asks for http://www.here.gov ... the local DNS serves up the internal address ... when someone outside requests that URL, it is given teh correct Outside address to access your site.

I believe the Pix can only "hairpin" from VPN tunnel to VPN tunnel (and only with recent code i.e., > 6.3{something}).

Good Luck

Scott