Privacy guaranteed - Your email is not shared with anyone.

Welcome to Glock Forum at

Why should YOU join our forums?

  • Reason #1
  • Reason #2
  • Reason #3

Site Description

cisco pix trouble

Discussion in 'Tech Talk' started by grantglock, Jan 11, 2005.

  1. grantglock

    grantglock /dev/null

    Feb 20, 2004
    its been a while since there was a good cisco question on here so i have one.

    here is some info about the network

    the ip address of the pix should be
    the gateway of the pix should be

    I want my internal network to be able to browse using NAT or PAT i dont care which one, as it is now that works fine.

    I have a webserver behind the pix that I would like to be able to reach using the public IP, that is where the problem is. It does not work. the address of the internal webserver is, it is accessible by typing from a workstation on the internal network.

    here is the output from sh xlate

    pixfirewall# sh xlate
    2 in use, 2 most used
    Global Local

    here is the output from sh run

    pixfirewall# sh run
    : Saved
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    hostname pixfirewall
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    access-list 100 permit icmp any any echo-reply
    access-list 100 permit icmp any any time-exceeded
    access-list 100 permit icmp any any unreachable
    access-list 100 permit tcp any host eq www
    pager lines 24
    logging on
    mtu outside 1500
    mtu inside 1500
    ip address outside
    ip address inside
    ip audit info action alarm
    ip audit attack action alarm
    pdm location inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1
    global (outside) 1
    nat (inside) 1 0 0
    static (inside,outside) netmask 0 0
    access-group 100 in interface outside
    route outside 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address inside
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    terminal width 80
    : end

    I've been working on this all day and I have not figured it out yet.
  2. NetNinja

    NetNinja Always Faithful

    Oct 23, 2001
    HotLanta, GA
    First you should set the range of inside I.P adresses

    Config t

    Nat (inside) 1 0

    Write terminal

    Write standby (that's if you have a failover Pix)

    That should work

    Then you need to set up your static list

    Static (inside,outside) netmask 0

    Then set up you conduits
    Since my Pix is using an older IOS I use conduits The newer IOS uses access lists. So look up in your IOS version how to use access lists.

    This allows the web server port 80 to be visable to the outside world.

    Conduit permit tcp host eq wwww any

    So in a nutshell

    Nat (inside) 1 0

    Static (inside,outside) netmask 0

    Conduit permit tcp host eq www any

    See if that works. I haven't looked over your entire config but that should do.

  3. grantglock

    grantglock /dev/null

    Feb 20, 2004
    I already have this statement

    static (inside,outside) netmask 0

    adding the conduit statement did not work.
  4. NetNinja

    NetNinja Always Faithful

    Oct 23, 2001
    HotLanta, GA
    I don't know if this makes a difference but your domain name is not It should be the domain name you are registered under.

    How about the Nat statement?

    Who handles your outside DNS?

    Is your domain name pointed to the right DNS?

    Is your registrar pointing to the correct DNS?

    Here is a suggestion

    go to

    register for the free account. It should give you 200 or 500 points for registering.

    Ask the same question in the Hardware/Cisco forum.

    Most likely a person named LRMoore will asnwer your question.

    He is the Cisco Ninja there.

    If you get your question answered please PM me. I would be very interested in what the solution was.
  5. grantglock

    grantglock /dev/null

    Feb 20, 2004
    you were correct, lrmoore responded with the correct answer, im afraid to tell you what it is though, its a stupid mistake.


    the gateway on the webserver was not set. there was nothing wrong with my pix config. I gave him 150 points for the answer.
  6. NetNinja

    NetNinja Always Faithful

    Oct 23, 2001
    HotLanta, GA
    DAMMIT! I knew it!

    Man! %#%$$@!

    I told myself "He must already have that inforamtion in his server".

    I am glad it worked out.

    Hey if you have enough memory install the PDM manager. The newest one is the Bomb!

    Unfortunately I don't have the newest one. :(

    What PIX model are you running?
  7. grantglock

    grantglock /dev/null

    Feb 20, 2004
    its the pix 501, It came with PDM ver 3 installed, sometimes i like to edit using the CLI, then i know exactly what is going on.
  8. proguncali

    proguncali 1911-2004 CLM

    Mar 14, 2002
    At your Mom's
    I have found that I can work much faster in a terminal that with the PDM.

    I think once you gt comfortable with the command structure you will rock out a PIX config double quick.

    I had a fun time doing site to site VPN, but after I added the default route;g ;g it worked...

    It's always the stupid crap that get us...;g ;g :soap: :soap:
  9. JMC


    Jun 8, 2002
    LOL!! You know, I was about to post that I saw nothing wrong with your config and I would start checking the server instead. I had one a week or two back where my server wouldn't talk to certain remote networks after we moved to a new gateway. Turned out there were two persistent routes in the server (which, of course, overrides the default gateway). Drove me nuts for a half hour checking my router configs before I decided to check the server's routing table.

    Also, in the future, when you post your config, you may want to at least scrub the password hash out of it.
  10. grantglock

    grantglock /dev/null

    Feb 20, 2004

    thats the default factory setting for now, telnet password is cisco and enable was blank. I would never leave it like that though.