PIX Firewall Configuration connected to ISP router.

[Lost & Found]

 sh version

     Cisco PIX Firewall Version 6.3(3)

Let say my ISP gae me the ff.

Wan: 111.96.55.18 /30

lan range: 111.96.53.122 - 111.96.53.140 /28

Brief summary of ISP Router

int f0/0 - 111.96.55.18 (outside) /30 

int f1/0 - 111.96.53.122 (inside) /28

Firewall 

interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100

Int e0/0 - Outside 111.96.53.123 /28

Int e0/1- Inside 10.34.63.88 /20

global (outside) 1 111.96.53.124-111.96.53.140 netmask 255.255.255.240 ( Im not sure with this line what should i use Public ip or Private?)
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 111.96.53.122 1

route inside 0.0.0.0 0.0.0.0 10.34.48.0 255.255.255.0 10.34.63.254 1

from firewall i cant ping to internet 8.8.8.8 

thanks

[Vibhor Amrodia]

Hi,

If you are using the PIX device for NAT translation , you should use the range :- 111.96.53.124-111.96.53.140.111.96.53.124-111.96.53.140

Thanks and Regards,

Vibhor Amrodia

[Lost & Found]

Hi,

What if the firewall be my outside interface going to ISP Default gateway what should i use as a global (outside) if there's no available ip address only for the outside interface??

thanks

[Vibhor Amrodia]

Hi,

Yes , if you don't have any available IP address , you can use the PIX interface for the Dynamic PAT.

Thanks and Regards,

VIbhor Amrodia

[Lost & Found]

Hi,

I'm Experiencing some issues going to outside(Internet).

My setup is

ISP to Pix FW to router to workstation (All straight through cables)

From firewall i can ping the ISP and the workstation

From router directly connected to FW I can't ping the outside interface.

from workstation i can't ping the outside interface of the firewall.

thanks hope you could help me with this

[Vibhor Amrodia]

Hi,

You would not be able to ping the Outside interface from the Workstation of the PIX device and this is expected.

Now , you should be able to ping the Outside interface of PIX from the ISP router.

Do you see any ARP on the ISP router for the PIX outside interface ?

Also check this command:-

icmp {permit | deny}ip_address net_mask[icmp_type]if_name

Thanks and Regards,

Vibhor Amrodia

[Lost & Found]

Hi,

Please see the attached photo. Actually From firewall I'm Directly connected to ISP(INTERNET) i don't have ISP Router.

firewall# sh run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NuLKvvWGg.x9HEKO encrypted
passwd NuLKvvWGg.x9HEKO encrypted
hostname firewall
domain-name none
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 1 permit any
access-list 100 permit ip any any
access-list 100 permit tcp any any
access-list 100 permit udp any any
access-list 100 permit icmp any any
access-list 100 permit icmp any host 10.34.48.139 echo
access-list 100 permit icmp any host 10.34.48.139 source-quench
access-list 100 permit icmp any host 10.34.48.139 unreachable
access-list 100 permit icmp any host 10.34.48.139 time-exceeded
access-list inbound permit icmp any any
access-list internal-out permit icmp any any echo-reply
access-list internal-out permit icmp any any time-exceeded
access-list internal-out permit icmp any any unreachable
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 111.96.55.18 255.255.255.252
ip address inside 10.34.63.59 255.255.240.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 100
nat (inside) 1 10.34.48.193 255.255.255.255 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 111.96.55.18 10.34.48.193 netmask 255.255.255.255 0 0
access-group 100 in interface outside
conduit permit icmp host 10.34.48.139 any echo
route outside 0.0.0.0 0.0.0.0 111.96.55.17 1
route inside 10.34.48.0 255.255.255.0 10.34.63.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.1 255.255.255.255 inside
http 10.34.48.0 255.255.240.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.34.48.0 255.255.240.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:52094a6c6379e76ec9c3965a233008da
: end

[Vibhor Amrodia]

Hi,

I think these are some of the misconfiguration and you should verify this part of the configuration:-

static (inside,outside) 111.96.55.18 10.34.48.193 netmask 255.255.255.255 0 0

ip address outside 111.96.55.18 255.255.255.252

route outside 0.0.0.0 0.0.0.0 121.96.66.17 1

The IP address range is completely different from the Route next hop for default route.

Secondly , you have statically natted INterface IP to an interface , this is incorrect and you cannot configure this. I would request you to remove this Static NAT and verify the next hop for the default route.

Thanks and Regards,

Vibhor Amrodia

static (inside,outside) 111.96.55.18 10.34.48.193 netmask 255.255.255.255 0 0 - See more at: https://supportforums.cisco.com/discussion/12497536/pix-firewall-configuration-connected-isp-router#sthash.O47CElGN.dpuf

[Lost & Found]

Hi,

sorry for that, I inputted the old configuration. but on my firewall it's correct.

Let say we disregard this

- static (inside,outside) 111.96.55.18 10.34.48.193 netmask 255.255.255.255 0 0

This is my config

ip address outside 111.96.55.18 255.255.255.252

route outside 0.0.0.0 0.0.0.0 111.96.55.17 1

but from workstation i ca't connect to internet although i a added or permit all ip on nat??

thanks

[Vibhor Amrodia]

Hi,

I think let's start from the baics:-

1) Are you able to ping the Next hop IP from the Outside interface of the PIX ?

2) Are you able to ping 4.2.2.1 from the outside interface IP from PIX ?

3) Are you able to ping from the Workstation to 4.2.2.1 ?

4) Try to add this :- fixup protocol icmp and then again try 4.2.2.1 ?

Thanks and Regards,

Vibhor Amrodia