Remote sites not able to route to Internet through main sites gateway

[admin_2]

Can anyone help me with the following problem. I have a client who has 4 remote sites connected via Frame Relay to the main site. They need to be able to browse the Internet from the remote sites by routing out through the main sites PIX as this is the only direct connection to the Internet.

Right now I can ping the PIX from the remote sites and if I add a route to the remote networks on the PIX I can ping back to the remote sites. If I try and do a traceroute from a remote site to an Internet address I can get as far as the first interface of the main sites router then timeout. I have tried making the PIX the default route for all traffic on this router and then defining routes to the remote sites but cannot seem to route remote sites all the way through. They can access a Citrix server at the main site though and we can ping every network from any network.

All help greatly appreciated.

Thanks.

[deilert]

DO you have a default route on the remote sites that go to the router that is connected to the Pix ?

ip route 0.0.0.0 0.0.0.0 x.x.x.x (ipaddressofrouterconnectedtopix)

Also on the router that is connected to the Pix you will need a default route pointing to the Pix

[rjackson]

Usually I say start troubleshooting with routing but it sounds like you have that covered.

In this case you have not mentioned the firewall functions of the pix. Is the pix configured to allow the inside addresses of the remote networks out to the internet? Are they in the access list for the nat pool?

[thisisshanky]

Are you able to get out to the internet, from the main site ?

The PIX should be configured with a NAT and GLOBAL command to allow inside traffic to get outside. A public NAT pool should be configured, or you can use PAT by overloading with the public ip address assigned to the outside interface.

[jcleary]

make sure that on the PIX you have the statements

Nat (inside)1 ipaddressofremotesites

global (outside)1 publicipaddress

-Joe

Can you paste the PIX configs?

[ocwa]

I have the same problem, I have cisco 4500 default route is PIX 515 and from pc connot traceroute internet IP addresses. Request timeout on 4500