Problem Browsing from a remote network

matthew.long · ‎08-04-2003

I have the following config running on a 515 UR

Internet

|

Pix -- Wan DMZ -- Router --- ATM Cloud---Router -- Remote Net

|

Internal

The problem I have is that my remote net can ping the internet but cannot browse.

This suggested to me either a NAT issue or Access lists.

I have put a sniffer on the outside network and I can see translated pings and web traffic exiting the network and responses coming back from the internet server but they just don't seem to reach the host on the remote network.

Any ideas?

Here are the line of the config relating to the WAN

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 WAN security40

access-list WAN_ACCESS_IN permit icmp any any

access-list WAN_ACCESS_IN permit ip any any

access-list NO_NAT_WAN permit ip object-group NO-NAT-LIST 192.168.1.0 255.255.255.0

ip address outside EXT-FW 255.255.255.240

ip address inside INT-FW 255.255.240.0

ip address WAN 172.16.16.250 255.255.255.0

global (outside) 1 interface

nat (inside) 0 access-list NO_NAT_INSIDE

nat (inside) 1 172.16.0.0 255.255.240.0 0 0

nat (WAN) 0 access-list NO_NAT_WAN

nat (WAN) 1 172.16.16.0 255.255.255.0 0 0 - Wan DMZ,

nat (WAN) 1 172.16.21.0 255.255.255.0 0 0 - Remote NEt

nat (WAN) 1 172.16.22.0 255.255.255.0 0 0 - Remote Net

static (inside,WAN) 172.16.0.0 172.16.0.0 netmask 255.255.240.0 0 0

access-group OUTSIDE_ACCESS_IN in interface outside

access-group WAN_ACCESS_IN in interface WAN

route outside 0.0.0.0 0.0.0.0 EXT-ROUTER 1

route WAN 172.16.21.0 255.255.255.0 WAN-ROUTER 1

route WAN 172.16.22.0 255.255.255.0 WAN-ROUTER 1

jmia · ‎08-04-2003

Hello Matthew,

Can you configure one of your inside PC's default-gateway as the inside interface IP addrs of the PIX and see if you can browse the internet??

Thanks --

matthew.long · ‎08-04-2003

Sorry, I don't understand how this would help.

The remote host has ip connectivity to the internet and I can ping and traceroute successfully.

Also, if i set the remote hosts DG to the pix how will the traffic know to go through the remote sites router.

jmia · ‎08-04-2003

Hi -

Sorry, misread your question, so you can not browse from the remote end. As you say, you can traceroute and ping then can you traceroute by IP and name www sites i.e. http://www.yahoo.com ??

And also, has your remote router got gateway of last resort set to point to the PIX, i.e.

> Gateway of last resort is to network 0.0.0.0 ?? and can you also, post you full PIX config + router config (remote end) please but remember to edit IP's and passwords.

Thanks --

jboyer · ‎08-05-2003

Routing is obviously not an issue if you can ping. Have you verifed DNS resolution by pinging a name instead of a number? Are there any access-list on the two routers? Also, try browsing and do a "show xlate" on the pix to verify the workstation's address appears correctly in the xlate table. If the issue still is not resolved post back the version of code you are running on the pix, it may be a bug.