cisco pix trouble

[grantglock]

its been a while since there was a good cisco question on here so i have one.

here is some info about the network

the ip address of the pix should be 65.174.244.183
the gateway of the pix should be 65.174.244.1

I want my internal network to be able to browse using NAT or PAT i dont care which one, as it is now that works fine.

I have a webserver behind the pix that I would like to be able to reach using the public IP 65.174.244.184, that is where the problem is. It does not work. the address of the internal webserver is 192.168.1.200, it is accessible by typing http://192.168.1.200 from a workstation on the internal network.

here is the output from sh xlate

pixfirewall# sh xlate
2 in use, 2 most used
Global 65.174.244.184 Local 192.168.1.200

here is the output from sh run

pixfirewall# sh run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit tcp any host 65.174.244.184 eq www
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 65.174.244.183 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 65.174.244.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 65.174.244.185-65.174.244.187
global (outside) 1 65.174.244.188
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.255 0 0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 65.174.244.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:2998ebea4cfcc468bbef55deeba70f56
: end

I've been working on this all day and I have not figured it out yet.

[NetNinja]

First you should set the range of inside I.P adresses

Config t

Nat (inside) 1 192.168.1.0 255.255.255.0 0

Write terminal

Write standby (that's if you have a failover Pix)

That should work

Then you need to set up your static list


Static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0


Then set up you conduits
Since my Pix is using an older IOS I use conduits The newer IOS uses access lists. So look up in your IOS version how to use access lists.

This allows the web server port 80 to be visable to the outside world.

Conduit permit tcp host 65.174.244.184 eq wwww any



So in a nutshell

Nat (inside) 1 192.168.1.0 255.255.255.0 0

Static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0

Conduit permit tcp host 65.174.244.184 eq www any



See if that works. I haven't looked over your entire config but that should do.

[grantglock]

I already have this statement

static (inside,outside) 65.174.244.184 192.168.1.200 netmask 255.255.255.0 0

adding the conduit statement did not work.

[NetNinja]

I don't know if this makes a difference but your domain name is not Ciscopix.com It should be the domain name you are registered under.



How about the Nat statement?

Who handles your outside DNS?

Is your domain name pointed to the right DNS?

Is your registrar pointing to the correct DNS?

Here is a suggestion

go to wwww.experts-exchange.com

register for the free account. It should give you 200 or 500 points for registering.

Ask the same question in the Hardware/Cisco forum.

Most likely a person named LRMoore will asnwer your question.

He is the Cisco Ninja there.

If you get your question answered please PM me. I would be very interested in what the solution was.

[grantglock]

you were correct, lrmoore responded with the correct answer, im afraid to tell you what it is though, its a stupid mistake.


ok,

the gateway on the webserver was not set. there was nothing wrong with my pix config. I gave him 150 points for the answer.

[NetNinja]

DAMMIT! I knew it!

Man! %#%$$@!

I told myself "He must already have that inforamtion in his server".

I am glad it worked out.

Hey if you have enough memory install the PDM manager. The newest one is the Bomb!

Unfortunately I don't have the newest one. :(


What PIX model are you running?

[grantglock]

its the pix 501, It came with PDM ver 3 installed, sometimes i like to edit using the CLI, then i know exactly what is going on.

[proguncali]

I have found that I can work much faster in a terminal that with the PDM.

I think once you gt comfortable with the command structure you will rock out a PIX config double quick.


I had a fun time doing site to site VPN, but after I added the default route;g ;g it worked...

It's always the stupid crap that get us...;g ;g :soap: :soap:

[JMC]

Originally posted by grantglock
the gateway on the webserver was not set. there was nothing wrong with my pix config.

LOL!! You know, I was about to post that I saw nothing wrong with your config and I would start checking the server instead. I had one a week or two back where my server wouldn't talk to certain remote networks after we moved to a new gateway. Turned out there were two persistent routes in the server (which, of course, overrides the default gateway). Drove me nuts for a half hour checking my router configs before I decided to check the server's routing table.

Also, in the future, when you post your config, you may want to at least scrub the password hash out of it.

[grantglock]

Originally posted by JMC
LOL!! You know, I was about to post that I saw nothing wrong with your config and I would start checking the server instead. I had one a week or two back where my server wouldn't talk to certain remote networks after we moved to a new gateway. Turned out there were two persistent routes in the server (which, of course, overrides the default gateway). Drove me nuts for a half hour checking my router configs before I decided to check the server's routing table.

Also, in the future, when you post your config, you may want to at least scrub the password hash out of it.


thats the default factory setting for now, telnet password is cisco and enable was blank. I would never leave it like that though.