06-28-2006 04:42 AM - edited 03-09-2019 03:25 PM
I want to connect my LAN to two remote offices in Dallas and Texas. I have two routers one for each office connected with T1 lines.Now I want to put the one PIX515e between my LAN to Dallas and Texas before both routers.So I have 3 ethernet interfaces. One connected with LAN switch, 2nd with Dallas router's ethernet and 3rd with Texas router's ethernet.following is the output of my PIX's sh run..
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 dallas security0
nameif ethernet1 inside security100
nameif ethernet2 texas security40
enable password xxxx
passwd xxxx
hostname xxxxxxxxx
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list acl_out permit ip any any
pager lines 24
icmp permit any dallas
icmp permit any inside
mtu dallas 1500
mtu inside 1500
mtu texas 1500
ip address dallas 172.26.29.2 255.255.255.0
ip address inside 172.26.22.10 255.255.255.0
ip address texas 10.46.46.2 255.255.255.0
ip verify reverse-path interface dallas
ip verify reverse-path interface inside
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (dallas) 1 172.26.29.10-172.26.29.50 netmask 255.255.255.0
global (dallas) 1 172.26.29.9 netmask 255.255.255.0
global (texas) 1 10.46.46.10-10.46.46.50 netmask 255.255.255.0
global (texas) 1 10.46.46.9
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group acl_out in interface dallas
access-group acl_out in interface inside
access-group acl_out in interface texas
route texas 10.2.1.0 255.255.255.0 10.46.46.1 1
route dallas 150.100.0.0 255.255.0.0 172.26.29.1 1
route dallas 192.168.30.0 255.255.255.0 172.26.29.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 172.26.22.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:xxxx
: end
But from my LAN side I am totally unable to connect with both offices... from within the PIX I can ping remote office computers but not from LAN computers... Help me out please.
06-28-2006 06:48 AM
I uploaded your config to a pix and from the inside was able to ping and telnet to the dallas router. This is a good indication I should be able to reach clients beyond that. As long as the rest of the network is working correctly.
You may want to do some trace routes from the inside to the other networks and from the other networks to the inside. Verify you have routes coming back from those internal networks as well.
06-28-2006 06:53 AM
On Dallas and texas network routers, there are route to my dallas and texas interface network IDs.I think there is no need for the route to my internal network ID because NAT is enabled.Am I right or wrong?
06-28-2006 07:13 AM
right.
Turn on logging on the pix. Do trace route and pings from both sides and if traffic is being denied you will see it in the loggs. If your not getting any denies you may want to capture traffic on the pix interfaces to see if the requests and/or reply's are acutally getting to the pix.
06-28-2006 11:13 PM
I tried to use logging on command. But there is nothing display on console window. Can you tell me the command with witch I can monitor passed and denied traffic from my PIX firewall?
06-29-2006 12:15 AM
I want to know the command which will enable logging for only denied or passed traffic from a particular source or to a specific destination for inside and outside....on PIX515e
06-29-2006 05:48 AM
logging on
logging console errors (connected via console cable)
logging monitor errors (connected via telnet/ssh, must also enable terminal monitor)
logging trap errors
logging host inside IP_ADDRESS (log to syslog on inside)
Link on how to capture:
06-29-2006 05:52 AM
This is just a useless reply but the last time I checked Dallas was in Texas :)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: