Re: PIX NAT Internet Configuration not working

richnam · ‎09-29-2007

Good day All,

I am connecting a LAN through a TDMA ip modem-router using a PIX in between. the PIX is doing routing, NAT, and DHCP for the LAN. However its not working. I can ping the internet via the console but get a 'request time-out' via the PIX LAN port. I also cannot browse the internet via the LAN port. I have attached my configurations. Please i need urgent help.

Regards,

Obinna.

ajagadee · ‎09-29-2007

Hi,

Couple of things that I can think of.

1. Is the user on the LAN confifugered as DHCP Clients.

2. Is the user getting an ip address from the pix.

3. Is the user able to ping the pix firewall's inside ip address.

4. In your configuration, you are NATing your 192.168.0.x/24 to Y.Y.Y.217-Y.Y.Y.222 ip addresses. Is this a valid range. Also, is the service provider advertising these address to the internet.

5. If you have some doubts around whether the service provider is advertising the above ip addresses are not. You could do a quick check by changing your NAT configuration to PAT all internal IP to the outside interface of the pix.

nat (inside) 1 192.168.0.0 255.255.255.0

global (outside) 1 interface

I hope it helps.

Regards,

Arul

** Please rate all helpful posts **

vpmorozov · ‎09-30-2007

Change that:

pixfirewall(config)# access-group 101 in interface outside

to

pixfirewall(config)# no access-group 101 in interface outside

pixfirewall(config)# access-group 101 in interface inside

And I suppose you should add at least that one rule:

pixfirewall(config)# access-list 101 permit tcp any any eq https

Good luck!

richnam · ‎10-01-2007

Thanks alot guys.

I have tried your suggestions step by step but it seems not working yet. i could still ping the internet through the console but not through the internal ip addresses.

Please help me out with more suggestions. this seems strange to me. looks to me like the nat is not functioning. I have PAT the internal IPs to the outside interface and this couldn't solve it either.

Regrd,

Obinna.

ajagadee · ‎10-01-2007

Hi,

Can you post the current configuration from the pix.

Thanks,

Arul

richnam · ‎10-01-2007

Hi Arul, I tried all the steps you gave but it is still not working. i've attached the configs. The Pix can give ip address settings but however, i can not get to the internet through the inside port. I PAT all inside ips to the outside interface but no result.

Regrds,

Obinna

vpmorozov · ‎10-01-2007

That would not be easy... ;-)

OK, Obinna, do following:

1. Log to the PIX through console

2. Go to privelege exec (enter "enable" command). Password should be blanc or "cisco".

3. Enter "show run". Press "Space" few times. You would get running config. Delete passwords and external IP and post it here.

richnam · ‎10-02-2007

Hi Guys, Thanks for your effort to help.

I have attached a copy of the "show run" of the PIX below.

G506Firewall# sh run

: Saved

:

PIX Version 6.3(5)

interface ethernet0 100basetx

interface ethernet1 100basetx

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password

passwd

hostname G506Firewall

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list 101 permit tcp any any eq www

access-list 101 permit icmp any any echo

access-list 101 permit icmp any any echo-reply

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside Y.Y.Y.174 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 Y.Y.Y.217-Y.Y.Y.222 netmask 255.255.255.248

nat (inside) 1 192.168.1.0 255.255.255.0 0 0

access-group 101 in interface outside

route outside 0.0.0.0 0.0.0.0 Y.Y.Y.173 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 inside

dhcpd dns X.X.160.8 X.X.162.8

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd enable inside

terminal width 80

Cryptochecksum:xxx

ajagadee · ‎10-02-2007

Thanks for the config.

I hate to ask you this again. Can you configure the pix to PAT to the outside Interface and then try to ping through the pix to a valid external IP Address.

If you get a response, well and good. If not, if there is no other traffic on this pix, do a deb icmp trace and post the outputs.

Regards,

Arul

vpmorozov · ‎10-02-2007

Hello!

Try to input

access-group 101 in interface inside

in config mode ("conf t" command in priveleged exec would guide you to G506Firewall(config)# )

richnam · ‎10-02-2007

hi guys,

i have tried the following

1. PAT all intrnal ip to the outside interface

2. access-group 101 in interface inside

and its still not working.

I begining to suspect the nat system has a problem. Please i'm still open to sugestions.

Regards,

Obinna

ajagadee · ‎10-03-2007

Obinna,

Interesting.

BTW, did you get a chance to capture "deb icmp trace" when you PAT the internal IP to the external interface. If so, please do post the outputs.

Also, to make sure that DHCP is not causing any issues here. Can you connect a PC directly to the inside interface, assign it a static ip and point the default gateway to the pix inside interface and try to ping outside through the pix and see if this works. If this works, then we know that there is something going on with DHCP, PIX and CLIENTS.

If the above test does not work, try rebooting the pix and test it again.

Let us know how it goes.

Regards,

Arul