Cannot access new website through PIX

At some point you might want to update to 6.3(5), as it has a number of bug fixes.

access-list 101 permit tcp any interface outside eq https access-list 101 permit tcp any interface outside eq www

static (inside,outside) tcp interface https isa https netmask 255.255.255.255 0 0 static (inside,outside) tcp interface www isa www netmask 255.255.255.255 0 0

DNS?

Configuring for DNS should not be necessary unless the OP is running an internal DNS server that outside people are querying. If the OP is using an external DNS service, then internal connections to that will be outgoing connections under the control of the outgoing ACL (if any), and the responses that come back within a reasonable period will get through because of the temporary exemption created by the Adaptive Security Algorithm when it sees the outgoing request.

Thanks so much for your quick reply! I really appreciate it.

The access-list additions went in no problem, but the 'static' entries error saying "ERROR: duplicate of existing static"

Thanks again

In article , wrote: :The access-list additions went in no problem, but the 'static' entries :error saying :"ERROR: duplicate of existing static"

Remove the existing statics first.

I was able to remove the existing static and put in the entries you mentioned but i am still not able to get the website to come up

In article , wrote: :I was able to remove the existing static and put in the entries you :mentioned but i am still not able to get the website to come up

The access-list entries I shows were not *additions* but *replacements*, and strange things can happen when you name an interface IP directly in an access list. Take out the old entries and try again, and if that doesn't work, please post the updated config.

Here we go. Still doesnt seem to be working. I wonder if I am trying to access the 'website' properly. I have a machine hooked up to the 'outside' interface with an ip of 10.10.10.254 and i am entering going to http://10.10.10.1/

heres the config

sh run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto shutdown nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security1 enable password passwd hostname 0gzr00 domain-name .dom fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.10.2 isa access-list 101 permit tcp any interface outside eq https access-list 101 permit tcp any interface outside eq www pager lines 24 mtu outside 1500 mtu inside 1500 mtu DMZ 1500 ip address outside 10.10.10.1 255.255.255.0 ip address inside 192.168.10.1 255.255.255.0 no ip address DMZ ip audit info action alarm ip audit attack action alarm pdm location 192.168.0.0 255.255.0.0 inside pdm logging informational 100 pdm history enable arp timeout 14400 static (inside,outside) tcp interface https isa https netmask

sh run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto shutdown nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security1 enable password passwd hostname 0gzr00 domain-name .dom fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.10.2 isa access-list 101 permit tcp any interface outside eq https access-list 101 permit tcp any interface outside eq www pager lines 24 mtu outside 1500 mtu inside 1500 mtu DMZ 1500 ip address outside 10.10.10.1 255.255.255.0 ip address inside 192.168.10.1 255.255.255.0 no ip address DMZ ip audit info action alarm ip audit attack action alarm pdm location 192.168.0.0 255.255.0.0 inside pdm logging informational 100 pdm history enable arp timeout 14400 static (inside,outside) tcp interface https isa https netmask

Have you rebooted the PIX since making the changes suggested by Walter? Sometimes a 'clear xlate' isn't enough and a reboot sorts it out.

Regards,

Nick Ersdown

I did end up getting it all to work. Thanks all for your help. I really appreciate it.