Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Pix 5.0 having 2 internet T-1's

I am replacing my current T-1 with another T-1 from different provider. I am trying to set my default route to go through my new T-1 rather than my existing T-1, but nothing I do seems to work. The firewall simply will not route to the new interface. I am getting syslog errors of "unable to create translation...", or something to that effect. i didn't write it down. I'm doing PAT.

---------------------------------------------------------------

<psuedo code. Syntax may be incorrect>

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 DMZ security50

nameif ethernet3 outside2 security10 <NEW T-1>

global outside2 1 192.168.1.5

nat (inside) 1 10.10.10.0 255.255.255.0

ip address outside 172.16.1.1 255.255.255.0

ip address inside 10.10.10.1 255.255.255.0

ip address outside2 192.168.1.1 255.255.255.0

route outside2 0.0.0.0 0.0.0.0 192.168.1.2

--------------------------------------------------------------

I have done a 'clear arp', 'clear xlate', nothing seems to work. However, I can ping the outside2 router from the pix, and I can ping any internet host through outside2 from the pix. Heck, I can even ping the outside2 router from an inside host. I just can't seem to get out to the internet. I would have thought clearing my translation tables and ARP cache would do it.

As soon as I change my global address to reflect my old line, and change my routes to my old line, everything comes right back up. I've used several IP Addresses for NAT, but just can't seem to get out.

Has anyone had any of these problems?? I've been working on this for weeks, and we are paying for a line that we can't use right now.

TIA!!!

7 REPLIES

Re: Pix 5.0 having 2 internet T-1's

Hi,

the above code seems to be ok. Is it possible to post the entire config? Are you sure there are no blocking ACLs in place?

Kind Regards,

Tom

New Member

Re: Pix 5.0 having 2 internet T-1's

No, no posting of my code, but I do understand why you would want to look at it. I basically have an ACL on my inside interface, and use conduits to go from my lower security interfaces to my higher.

That's it. The only other configurations on my firewall is IPSec information not in use anymore, and failover configurations.

Are there any commands that I am not thinking of to reset anything? I cleared my ARP and translations. Could it be a security level issue? Being that I am re-routing my default route to a level of 15 and not 0?

Or could it be because my software level is so low. We are running 5.0(2) on a Pix 520.

New Member

Re: Pix 5.0 having 2 internet T-1's

After any changes in IP addresses or routing, Cisco recommends to use "clear xlate" command. Another thing I would recommend - save configuration and reboot firewall (may be off-hours).

Good luck.

New Member

Re: Pix 5.0 having 2 internet T-1's

Thanks for your response. However, I've used "clear xlate" too many times to remember. My translations are still not working. I think I got this error in my syslog, but can't remember, since I've done some other work:

Log Message %PIX-3-305006: translation creation failed for

New Member

Re: Pix 5.0 having 2 internet T-1's

It is my understanding that the PIX will only support one default gateway.

How will it know which interface to send traffic out?

If you are replacing then do just that.

Replace your original outside inteface to 192.168...... your global outside, and your default route all out the outside interface.

Skip the outside2 thing and keep it simple.

If you are not migrating and you want to use both that is a whole other story.

New Member

Re: Pix 5.0 having 2 internet T-1's

tmoreo,

Thanks! I am only allowing it to use one default gateway. The problem is, no traffic is passed through. I've even done what you had said (although I left that part out), in that I renamed my interfaces (the old outside interface I named to outside2, and my new line I named to outside).

Unfortunately this did not work either. My Globals and NAT were redefined every time to reflect the new line. My Pix OS is severely outdated 5.0(2) so I am in the process of upgrading before trying again.

And no, you are correct. This is a migration, and not additional lines.

New Member

Re: Pix 5.0 having 2 internet T-1's

Is your problem solved?

First, you should try to isolate your problem. To do that, it's better to begin with your Internet gateway router, the new one. Are you able to surf from this point. Make a ping or telnet from this router ? If not, forget the PIX, the problem isn't this box. Second, are you able to surf from the 192.168 network, the one between the new router and the new PIX's interface. Your problem is perhaps a routing one, not related to PIX.

As the last poster said, it's better to remove the outside2 stuff, just keep your initial outside interface and flip the new T1 & his router to this interface.

Also, take care of double NATting, sometimes, it's not working properly.

Ben

164
Views
0
Helpful
7
Replies
CreatePlease login to create content