Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX-501 no internet access

PIX newbie here,

I cannot get access to internet through my PIX-503 version 6.3(3)

I can ping from pc, and dhcp assign IP from firewall too, but cannot get out!

I have ISP router cable in port 0 and cable to LAN hub is in port 1.

my router IP (example) 10.0.0.7

my outside gateway ip 10.0.0.22

what is wrong with my config?

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password Password encrypted

passwd Password encrypted

hostname OfficeName

domain-name DomainName.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

name insideIP VPNHEADEND

name outsideIP MailServer

name outsideIP .0 HomeOffc

access-list inside_outbound_nat0_acl permit ip insideIP 255.255.255.0 VPNHEADEND 255.255.255.0

access-list outside_cryptomap_20 permit ip insideIP 255.255.255.0 VPNHEADEND 255.255.255.0

access-list outside_access_in permit ip VPNHEADEND 255.255.255.0 any

access-list outside_access_in permit tcp host MailServer any

access-list outside_access_in permit ip HomeOffc 255.255.255.0 host outsideIP

access-list outside_access_in permit ip host 10.0.0.7 any

pager lines 24

logging on

logging timestamp

logging console warnings

logging buffered warnings

logging trap informational

mtu outside 1500

mtu inside 1500

ip address outside 10.0.0.22 255.255.255.xxx

ip address inside insidegatewayIP 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location insideIP 255.255.255.255 inside

pdm location VPNHEADEND 255.255.255.0 outside

pdm location MailServer 255.255.255.255 outside

pdm location HomeOffc 255.255.255.0 outside

pdm location outsideIP 255.255.255.0 outside

pdm location 10.0.0.22 255.255.255.255 outside

pdm logging warnings 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 10.0.0.22 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http outsideIP 255.255.255.0 outside

http HomeOffc 255.255.255.0 outside

http insideIP.0 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set esp-3des-md5 esp-3des esp-sha-hmac

crypto map outside_map 20 ipsec-isakmp

crypto map outside_map 20 match address outside_cryptomap_20

crypto map outside_map 20 set peer outsideIP

crypto map outside_map 20 set transform-set esp-3des-md5

crypto map outside_map interface outside

isakmp enable outside

isakmp key Password address outsideIP netmask 255.255.255.255 no-xauth no-config-mode

isakmp key Password address outsideIP netmask 255.255.255.255 no-xauth no-config-mode

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash sha

isakmp policy 20 group 2

isakmp policy 20 lifetime 28800

telnet insideIP 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address insideIP range inside

dhcpd dns outside DNS IP

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd domain DomainName.com

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Any help is appreciated!

2 REPLIES
New Member

Re: PIX-501 no internet access

Can you ping a public IP from the PIX? Can you ping your Internet gateway from the pix (10.0.0.21)? If not, make sure that your router and the outside interface of the PIX have the proper speed and duplex settings.

Gold

Re: PIX-501 no internet access

Hi,

What error message do you get when you try to do nslookup from a inside PC? Also can you provide some syslog messages, do the following:

logging on

logging buffer debug

sh log

Can you post the above result.

Thanks - Jay

260
Views
0
Helpful
2
Replies