Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

PIX 525 Configuration help

Hello,

I am testing a DSL business line with a PIX 525 firewall.

I have an Internal network of 197.39.101.0/26. (The IP addresses for the inside and outside networks were changed.)

The external IP address is dynamically assigned from the ISP.

I created a nat for the inside network and used a global command for the outside.

Then I statically assigned an external IP to an internal IP.

I opened up all tcp, upd, icmp, ip traffic and port 80 and 7047.

From the Internet I would like to get to test the following:

1) ping 68.39.213.197

2) trace route 68.39.213.197

3) http://68.39.213.197:7047

4) http://68.39.213.197

None of the above seem to be working.

I have attached the configuration file.

Can anyone see any problems with this configuration?

Can anyone help?

Your help would be greatly appreciated. Thank you.

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

PIX Version 8.0(4)

!

hostname fw2

domain-name testing.com

names

dns-guard

!

interface Ethernet0

nameif outside

security-level 0

pppoe client vpdn group test-pppoe-att

ip address pppoe setroute

!

interface Ethernet1

nameif inside

security-level 100

ip address 197.39.101.33 255.255.255.192 standby 197.39.101.34

!

interface Ethernet2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet3

description STATE Failover Interface

!

interface Ethernet4

nameif management

security-level 100

ip address 192.168.100.1 255.255.255.0 standby 192.168.100.2

management-only

!

interface Ethernet5

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns domain-lookup outside

dns domain-lookup inside

dns domain-lookup management

dns server-group DefaultDNS

domain-name testing.com

access-list OUT_IN extended permit tcp any host 68.39.213.197 eq www

access-list OUT_IN extended permit tcp any host 68.39.213.197 eq 7047

access-list OUT_IN extended permit tcp any any

access-list OUT_IN extended permit udp any any

access-list OUT_IN extended permit icmp any any

access-list OUT_IN extended permit ip any any

access-list 101 extended permit tcp any any

access-list 101 extended permit udp any any

access-list 101 extended permit icmp any any

access-list 101 extended permit ip any any

pager lines 24

logging enable

logging timestamp

logging buffer-size 1048576

logging trap errors

logging history errors

logging asdm errors

logging host inside 197.39.101.27

logging permit-hostdown

mtu outside 1500

mtu inside 1500

mtu management 1500

failover

failover link failover Ethernet3

failover interface ip failover 192.168.6.254 255.255.255.0 standby 192.168.6.253

no monitor-interface outside

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm-61551.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 197.39.101.0 255.255.255.0

static (inside,outside) 68.39.213.197 197.39.101.87 netmask 255.255.255.255

access-group OUT_IN in interface outside

access-group 101 in interface inside

route inside 197.39.101.0 255.255.255.0 197.39.101.62 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 197.39.101.0 255.255.255.0 inside

http 192.168.100.0 255.255.255.0 management

snmp-server host inside 197.39.101.25 community testmgmt version 2c

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 197.39.101.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

vpdn group test-pppoe-att request dialout pppoe

vpdn group test-pppoe-att localname testing@att.net

vpdn group test-pppoe-att ppp authentication pap

vpdn username testing@att.net password *****************************

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 197.39.101.20 source inside prefer

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:be07d15845e099d1c208c0e6a1360176

: end

Version history
Revision #:
1 of 1
Last update:
‎05-15-2012 01:53 PM
Updated by:
 
Labels (1)
Everyone's tags (4)