what do the syslogs say? do some debugging to see what you get. otherwise, it would be much appreciated if you could post your config. there maybe something else silly that you have overlooked.....everybody does it from time to time...even those that can dream the PIX..... ... View more

this should help out as well, but they above did a good job too. http://www.cisco.com/cgi-bin/Support/browse/psp_view.pl?p=Internetworking:ACCESS-LIST_ARP_BOOT_DHCP another good one... http://www.cisco.com/warp/customer/105/acl_wp.html hope this helps some... ... View more

this should be very helpful to you. http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/syslog/pixemapa.htm do a search on the message code....example in your case 106023. hope this helps. ... View more

well then if there correct there correct. i was only trying to get a better understanding, because i got confused when above you stated that you used a "STATIC" to point your client to the external DNS. i wasn't sure why you didn't use a combination of global, nat, and acls. i was under the impression that "STATIC" commands were only used to make exceptions in the pixes ASA. good luck! ... View more

if it isn't any trouble can you please paste your pix config (minus the sensitive info)? also, can you let me know which interface the clients/ systems are off of that aren't working? also, can you let me know which interface the internal dns is off of that these clients normally point to for dns? thanks! ... View more

just for testing have you tried to take a inside client and point it to the outside DNS to see if it works? ... View more

additional information would be very helpful. reason being, i am kind of confused on this, and why you believe it is your firewall??? if you can get to certain .mil sites and then when you need to try and get to certain links off that site it doesn't work....right. are the sites you can get to and the ones you cannot in the same domain? meaning, are they all under (example) http://www.noway.mil. is the good site http://www.noway.mil and the links they need to get to http://www.noway.mil/notgoingtohappen/nochance.html?? or something like that, or are they completely different domains?? http://www.noway.mil and http://www.lastchance.mil?? as i said above additional information would be great, and i am not so sure this is pointing at your firewall, but more information is needed. thanks. ... View more

we do a lot of work with the DoD. what are the urls? the good ones and the bad ones. maybe i can help after i look at it. just as a fyi...the DoD does a lot of reverse proxy stuff, and they also have a lot of caching engines that do different things, but lets to a look. let me know. ... View more

http://www.jsifaq.com/SUBM/tip6200/rh6234.htm nice high-level overview of what ports and services do what. hope this helps. ... View more

could be helpful before you paste. % PIX-3-305005: No translation group found for protocol src interface_name:dest_address/dest_port dst interface_name:source_address/source_port Explanation A packet does not match any of the outbound nat rules. Action This message signals a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the access-list bound to the nat 0 access-list. ... View more

sorry, make sure all the nat and global information is here as well. thanks. ... View more

is it possible to paste both A & B's configs in here. please x-out all of your sensitive information. this will help out a lot. specifically the all the statics and the acls....but the entire config will do. thanks. ... View more

hope this link helps. and if you need additional help after reading though...please post again. take care. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00800a2cce.shtml#diag ... View more

could you please give some more information? we have a lot of unix admins that use X. it is working just fine. remember you need to have a acl that has the system (server) as the source, and the admins machine as the destination. thanks. ... View more