close

Privacy guaranteed - Your email is not shared with anyone.

cisco pix trouble

Discussion in 'Tech Talk' started by grantglock, Jan 11, 2005.


  1. grantglock

    grantglock
    Expand Collapse
    /dev/null

    Joined:
    Feb 20, 2004
    219
    0
    Location:
    Iowa
    its been a while since there was a good cisco question on here so i have one.

    here is some info about the network

    the ip address of the pix should be 65.174.244.183
    the gateway of the pix should be 65.174.244.1

    I want my internal network to be able to browse using NAT or PAT i dont care which one, as it is now that works fine.

    I have a webserver behind the pix that I would like to be able to reach using the public IP 65.174.244.184, that is where the problem is. It does not work. the address of the internal webserver is 192.168.1.200, it is accessible by typing http://192.168.1.200 from a workstation on the internal network.

    here is the output from sh xlate

    pixfirewall# sh xlate
    2 in use, 2 most used
    Global 65.174.244.184 Local 192.168.1.200

    here is the output from sh run

    pixfirewall# sh run
    : Saved
    :
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    hostname pixfirewall
    domain-name ciscopix.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list 100 permit icmp any any echo-reply
    access-list 100 permit icmp any any time-exceeded
    access-list 100 permit icmp any any unreachable
    access-list 100 permit tcp any host 65.174.244.184 eq www
    pager lines 24
    logging on
    mtu outside 1500
    mtu inside 1500
    ip address outside 65.174.244.183 255.255.255.0
    ip address inside 192.168.1.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm location 65.174.244.0 255.255.255.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 65.174.244.185-65.174.244.187
    global (outside) 1 65.174.244.188
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.255 0 0
    access-group 100 in interface outside
    route outside 0.0.0.0 0.0.0.0 65.174.244.1 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.129 inside
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    terminal width 80
    Cryptochecksum:2998ebea4cfcc468bbef55deeba70f56
    : end

    I've been working on this all day and I have not figured it out yet.
     

    Wanna kill these ads? We can help!
  2. NetNinja

    NetNinja
    Expand Collapse
    Always Faithful

    Joined:
    Oct 23, 2001
    967
    0
    Location:
    HotLanta, GA
    First you should set the range of inside I.P adresses

    Config t

    Nat (inside) 1 192.168.1.0 255.255.255.0 0

    Write terminal

    Write standby (that's if you have a failover Pix)

    That should work

    Then you need to set up your static list


    Static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0


    Then set up you conduits
    Since my Pix is using an older IOS I use conduits The newer IOS uses access lists. So look up in your IOS version how to use access lists.

    This allows the web server port 80 to be visable to the outside world.

    Conduit permit tcp host 65.174.244.184 eq wwww any



    So in a nutshell

    Nat (inside) 1 192.168.1.0 255.255.255.0 0

    Static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0

    Conduit permit tcp host 65.174.244.184 eq www any



    See if that works. I haven't looked over your entire config but that should do.
     

  3. grantglock

    grantglock
    Expand Collapse
    /dev/null

    Joined:
    Feb 20, 2004
    219
    0
    Location:
    Iowa
    I already have this statement

    static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0

    adding the conduit statement did not work.
     
  4. NetNinja

    NetNinja
    Expand Collapse
    Always Faithful

    Joined:
    Oct 23, 2001
    967
    0
    Location:
    HotLanta, GA
    I don't know if this makes a difference but your domain name is not Ciscopix.com It should be the domain name you are registered under.



    How about the Nat statement?

    Who handles your outside DNS?

    Is your domain name pointed to the right DNS?

    Is your registrar pointing to the correct DNS?

    Here is a suggestion

    go to wwww.experts-exchange.com

    register for the free account. It should give you 200 or 500 points for registering.

    Ask the same question in the Hardware/Cisco forum.

    Most likely a person named LRMoore will asnwer your question.

    He is the Cisco Ninja there.

    If you get your question answered please PM me. I would be very interested in what the solution was.
     
  5. grantglock

    grantglock
    Expand Collapse
    /dev/null

    Joined:
    Feb 20, 2004
    219
    0
    Location:
    Iowa
    you were correct, lrmoore responded with the correct answer, im afraid to tell you what it is though, its a stupid mistake.


    ok,

    the gateway on the webserver was not set. there was nothing wrong with my pix config. I gave him 150 points for the answer.
     
  6. NetNinja

    NetNinja
    Expand Collapse
    Always Faithful

    Joined:
    Oct 23, 2001
    967
    0
    Location:
    HotLanta, GA
    DAMMIT! I knew it!

    Man! %#%$$@!

    I told myself "He must already have that inforamtion in his server".

    I am glad it worked out.

    Hey if you have enough memory install the PDM manager. The newest one is the Bomb!

    Unfortunately I don't have the newest one. :(


    What PIX model are you running?
     
  7. grantglock

    grantglock
    Expand Collapse
    /dev/null

    Joined:
    Feb 20, 2004
    219
    0
    Location:
    Iowa
    its the pix 501, It came with PDM ver 3 installed, sometimes i like to edit using the CLI, then i know exactly what is going on.
     
  8. proguncali

    proguncali
    Expand Collapse
    1911-2004
    CLM

    Joined:
    Mar 14, 2002
    2,608
    0
    Location:
    At your Mom's
    I have found that I can work much faster in a terminal that with the PDM.

    I think once you gt comfortable with the command structure you will rock out a PIX config double quick.


    I had a fun time doing site to site VPN, but after I added the default route;g ;g it worked...

    It's always the stupid crap that get us...;g ;g :soap: :soap:
     
  9. JMC

    JMC
    Expand Collapse

    Joined:
    Jun 8, 2002
    76
    0
    LOL!! You know, I was about to post that I saw nothing wrong with your config and I would start checking the server instead. I had one a week or two back where my server wouldn't talk to certain remote networks after we moved to a new gateway. Turned out there were two persistent routes in the server (which, of course, overrides the default gateway). Drove me nuts for a half hour checking my router configs before I decided to check the server's routing table.

    Also, in the future, when you post your config, you may want to at least scrub the password hash out of it.
     
  10. grantglock

    grantglock
    Expand Collapse
    /dev/null

    Joined:
    Feb 20, 2004
    219
    0
    Location:
    Iowa

    thats the default factory setting for now, telnet password is cisco and enable was blank. I would never leave it like that though.