Good day All,
I am connecting a LAN through a TDMA ip modem-router using a PIX in between. the PIX is doing routing, NAT, and DHCP for the LAN. However its not working. I can ping the internet via the console but get a 'request time-out' via the PIX LAN port. I also cannot browse the internet via the LAN port. I have attached my configurations. Please i need urgent help.
Couple of things that I can think of.
1. Is the user on the LAN confifugered as DHCP Clients.
2. Is the user getting an ip address from the pix.
3. Is the user able to ping the pix firewall's inside ip address.
4. In your configuration, you are NATing your 192.168.0.x/24 to Y.Y.Y.217-Y.Y.Y.222 ip addresses. Is this a valid range. Also, is the service provider advertising these address to the internet.
5. If you have some doubts around whether the service provider is advertising the above ip addresses are not. You could do a quick check by changing your NAT configuration to PAT all internal IP to the outside interface of the pix.
nat (inside) 1 192.168.0.0 255.255.255.0
global (outside) 1 interface
I hope it helps.
** Please rate all helpful posts **
pixfirewall(config)# access-group 101 in interface outside
pixfirewall(config)# no access-group 101 in interface outside
pixfirewall(config)# access-group 101 in interface inside
And I suppose you should add at least that one rule:
pixfirewall(config)# access-list 101 permit tcp any any eq https
Thanks alot guys.
I have tried your suggestions step by step but it seems not working yet. i could still ping the internet through the console but not through the internal ip addresses.
Please help me out with more suggestions. this seems strange to me. looks to me like the nat is not functioning. I have PAT the internal IPs to the outside interface and this couldn't solve it either.
Hi Arul, I tried all the steps you gave but it is still not working. i've attached the configs. The Pix can give ip address settings but however, i can not get to the internet through the inside port. I PAT all inside ips to the outside interface but no result.
That would not be easy... ;-)
OK, Obinna, do following:
1. Log to the PIX through console
2. Go to privelege exec (enter "enable" command). Password should be blanc or "cisco".
3. Enter "show run". Press "Space" few times. You would get running config. Delete passwords and external IP and post it here.
Hi Guys, Thanks for your effort to help.
I have attached a copy of the "show run" of the PIX below.
G506Firewall# sh run
PIX Version 6.3(5)
interface ethernet0 100basetx
interface ethernet1 100basetx
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 101 permit tcp any any eq www
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any echo-reply
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside Y.Y.Y.174 255.255.255.252
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 Y.Y.Y.217-Y.Y.Y.222 netmask 255.255.255.248
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 Y.Y.Y.173 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 inside
dhcpd dns X.X.160.8 X.X.162.8
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Thanks for the config.
I hate to ask you this again. Can you configure the pix to PAT to the outside Interface and then try to ping through the pix to a valid external IP Address.
If you get a response, well and good. If not, if there is no other traffic on this pix, do a deb icmp trace and post the outputs.
Try to input
access-group 101 in interface inside
in config mode ("conf t" command in priveleged exec would guide you to G506Firewall(config)# )
i have tried the following
1. PAT all intrnal ip to the outside interface
2. access-group 101 in interface inside
and its still not working.
I begining to suspect the nat system has a problem. Please i'm still open to sugestions.
BTW, did you get a chance to capture "deb icmp trace" when you PAT the internal IP to the external interface. If so, please do post the outputs.
Also, to make sure that DHCP is not causing any issues here. Can you connect a PC directly to the inside interface, assign it a static ip and point the default gateway to the pix inside interface and try to ping outside through the pix and see if this works. If this works, then we know that there is something going on with DHCP, PIX and CLIENTS.
If the above test does not work, try rebooting the pix and test it again.
Let us know how it goes.