Problem: possible PIX routing table conflict
Replaced existing routes but new routes are not taking effect. I want traffic bound for 10.67.77.222 to be routed to the PIX outside but it consistently builds a connection to the inside and gives a 'no route' error. See below.
HOST SESSION
---
[rootjh@testmachine] /home/rootjh-> sftp testuser@10.67.77.222
Connecting to 10.67.77.222...
ssh: connect to host 10.67.77.222 port 22: A remote host did not respond within the timeout period.
Connection closed
[rootjh@testmachine] /home/rootjh->
SYSLOG SESSION (PIX LOG)
---
syslog01:/var/log # tail -f /var/log/PIX | grep 10.67.77.222
Oct 21 09:28:28 10.67.11.11 Oct 21 2005 09:28:25: %PIX-6-302013: Built inbound TCP connection 17056297 for dmz:192.168.33.44/40956 (192.168.33.44/40956) to inside:10.67.77.222/22 (10.67.77.222/22)
Oct 21 09:28:28 10.67.11.11 Oct 21 2005 09:28:25: %PIX-6-110001: No route to 10.67.77.222 from 192.168.33.44
Oct 21 09:28:48 10.67.11.11 Oct 21 2005 09:28:46: %PIX-6-110001: No route to 10.67.77.222 from 192.168.33.44
Oct 21 09:30:30 10.67.11.11 Oct 21 2005 09:30:27: %PIX-6-302014: Teardown TCP connection 17056297 for dmz:192.168.33.44/40956 to inside:10.67.77.222/22 duration 0:02:01 bytes 0 SYN Timeout
PIX CONFIG
---
**Previous route was removed and the range split in two:
no route inside 10.67.0.0 255.255.0.0 10.67.1.1 1
route inside 10.67.0.0 255.255.192.0 10.67.1.1 1
route inside 10.67.100.0 255.255.252.0 10.67.1.1 1
**This route was added (routes to outside, not inside):
route outside 10.67.77.222 255.255.255.255 10.68.68.68 1
access-list dmz permit tcp host 192.168.33.44 host 10.67.77.222 eq ssh
static (dmz,outside) 10.67.77.222 10.67.77.222 netmask 255.255.255.255 0 0
route outside 10.67.77.222 255.255.255.255 10.68.68.68 1
I have done a 'clear xlate' for 10.67.77.222 and it pops into the xlate table as soon as I try the connection. Again, the connection is made in the wrong direction.
I have searched the config for all references to the new IP address (10.67.77.222)
I suspect the PIX is remembering the old route, where all 10.67.0.0/16 pointed to the inside and is refusing to allow the new /32 host route to go to the outside.
I am planning a reboot of the PIX for next week, unless someone has any ideas.
Thanks,
