PIX 501: DHCP on outside interface will not renew

Greetings. I am trying to set up a PIX 501 for use in a SOHO environment, with cable Internet access and a dynamic IP address.

I want to open up a port for public access so I am trying to test the PIX's ability to handle a change in my public IP address from my ISP. I cannot get my actual ISP-assigned public IP address to change on demand, so I put a Linksys router in between my cable modem and the PIX. I have the PIX getting its outside IP address from the Linksys via DHCP.

The problem is that the PIX will successfully get its outside IP address dynamically when I first boot the PIX, but if I tamper with the DHCP server (my Linksys router) at all--even changes that should have no effect on DHCP (like just re-saving the Linksys config with no changes right after the PIX successfully get its outside IP via DHCP), the PIX will lose its outside IP address and never get it back. My config and testing appears below. Any help will be greatly appreciated!

--------------------------------------------------------------------------- pixfirewall(config)# wr t Building configuration... : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixfirewall domain-name ciscopix.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.1.66 wwwServer name 192.168.1.71 EcWorkstation_01 access-list inbound permit tcp any interface outside eq www pager lines 24 icmp deny any echo outside mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.1.1 255.255.255.0 ip verify reverse-path interface outside ip audit info action alarm ip audit attack action alarm pdm location wwwServer 255.255.255.255 inside pdm location EcWorkstation_01 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface www wwwServer www netmask

255.255.255.255 0 0 access-group inbound in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http EcWorkstation_01 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 5 ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:cd27035eb1aaf10a257e562b16c8b3e2 : end [OK] pixfirewall(config)# reload Proceed with reload? [confirm]

Rebooting....

CISCO SYSTEMS PIX-501 Embedded BIOS Version 4.3.200 07/31/01 15:58:22.08 Compiled by morlee

16 MB RAM

PCI Device Table. Bus Dev Func VendID DevID Class Irq 00 00 00 1022 3000 Host Bridge 00 11 00 8086 1209 Ethernet 9 00 12 00 8086 1209 Ethernet 10

Cisco Secure PIX Firewall BIOS (4.2) #6: Mon Aug 27 15:09:54 PDT 2001 Platform PIX-501 Flash=E28F640J3 @ 0x3000000

Use BREAK or ESC to interrupt flash boot. Use SPACE to begin flash boot immediately. Reading 1962496 bytes of image from flash. ################################################################################ ###############################

16MB RAM mcwa i82559 Ethernet at irq 9 MAC: 0011.935f.0123 mcwa i82559 Ethernet at irq 10 MAC: 0011.935f.0124 Flash=E28F640J3 @ 0x3000000 BIOS Flash=E28F640J3 @ 0xD8000

----------------------------------------------------------------------- || || || || |||| |||| ..:||||||:..:||||||:.. c i s c o S y s t e m s Private Internet eXchange

----------------------------------------------------------------------- Cisco PIX Firewall

Cisco PIX Firewall Version 6.3(4) Licensed Features: Failover: Disabled VPN-DES: Enabled VPN-3DES-AES: Enabled Maximum Physical Interfaces: 2 Maximum Interfaces: 2 Cut-through Proxy: Enabled Guards: Enabled URL-filtering: Enabled Inside Hosts: 10 Throughput: Unlimited IKE peers: 10

This PIX has a Restricted (R) license.

****************************** Warning ******************************* Compliance with U.S. Export Laws and Regulations - Encryption.

This product performs encryption and is regulated for export by the U.S. Government.

This product is not authorized for use by persons located outside the United States and Canada that do not have prior approval from Cisco Systems, Inc. or the U.S. Government.

This product may not be exported outside the U.S. and Canada either by physical or electronic means without PRIOR approval of Cisco Systems, Inc. or the U.S. Government.

Persons outside the U.S. and Canada may not re-export, resell or transfer this product by either physical or electronic means without prior approval of Cisco Systems, Inc. or the U.S. Government. ******************************* Warning

*******************************

Copyright (c) 1996-2003 by Cisco Systems, Inc.

Restricted Rights Legend

Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706

.... Allocated IP address = 192.168.15.100, netmask = 255.255.255.0, gateway = 192.1

68.15.1 outside interface address added to PAT pool . Cryptochecksum(unchanged): cd27035e b1aaf10a 257e562b 16c8b3e2 Type help or '?' for a list of available commands. pixfirewall>

Cannot select private key pixfirewall> en Password: pixfirewall# wr t Building configuration... : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixfirewall domain-name ciscopix.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.1.66 wwwServer name 192.168.1.71 EcWorkstation_01 access-list inbound permit tcp any interface outside eq www pager lines 24 icmp deny any echo outside mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 192.168.1.1 255.255.255.0 ip verify reverse-path interface outside ip audit info action alarm ip audit attack action alarm pdm location wwwServer 255.255.255.255 inside pdm location EcWorkstation_01 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface www wwwServer www netmask

255.255.255.255 0 0 access-group inbound in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http EcWorkstation_01 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet timeout 5 ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:cd27035eb1aaf10a257e562b16c8b3e2 : end [OK] pixfirewall# show ip address outside dhcp

Temp IP addr: 192.168.15.100 for peer on Interface: outside Temp sub net mask: 255.255.255.0 DHCP Lease server: 192.168.15.1, state: 3 Bound DHCP transaction id: 0x624E Lease: 86400 secs, Renewal: 43200 secs, Rebind: 75600 secs Temp default-gateway addr: 192.168.15.1 Next timer fires after: 43150 seconds Retry count: 0 Client-ID: cisco-0011.935f.0123-outside pixfirewall# show ip address outside dhcp

Temp IP addr: 192.168.15.100 for peer on Interface: outside Temp sub net mask: 255.255.255.0 DHCP Lease server: 192.168.15.1, state: 3 Bound DHCP transaction id: 0x624E Lease: 86400 secs, Renewal: 43200 secs, Rebind: 75600 secs Temp default-gateway addr: 192.168.15.1 Next timer fires after: 43097 seconds Retry count: 0 Client-ID: cisco-0011.935f.0123-outside (Now I simply save existing config on DHCP server (Linksys router)-- with no changes of any kind.) pixfirewall# show ip address outside dhcp

Temp IP addr: 0.0.0.0 for peer on Interface: outside Temp sub net mask: 0.0.0.0 DHCP Lease server: 0.0.0.0, state: 1 Selecting DHCP transaction id: 0xE1E6 Lease: 0 secs, Renewal: 0 secs, Rebind: 0 secs Next timer fires after: 0 seconds Retry count: 1 Client-ID: cisco-0011.935f.0123-outside pixfirewall# debug dhcpc packet pixfirewall# DHCP: allocate request DHCP: zapping entry in DHC_PURGING state for outside DHCP: new entry. add to queue DHCP: SDiscover attempt # 1 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: SDiscover attempt # 2 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: SDiscover attempt # 3 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: allocate request DHCP: zapping entry in DHC_PURGING state for outside DHCP: new entry. add to queue DHCP: SDiscover attempt # 1 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: deleting entry a8b434 0.0.0.0 from list Temp IP addr: 0.0.0.0 for peer on Interface: unknown Temp sub net mask: 0.0.0.0 DHCP Lease server: 0.0.0.0, state: 8 Purging DHCP transaction id: 0x1D715 Lease: 0 secs, Renewal: 0 secs, Rebind: 0 secs No timer running Retry count: 0 Client-ID:

DHCP: SDiscover attempt # 2 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: SDiscover attempt # 3 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 DHCP: deleting entry aada64 0.0.0.0 from list Temp IP addr: 0.0.0.0 for peer on Interface: unknown Temp sub net mask: 0.0.0.0 DHCP Lease server: 0.0.0.0, state: 8 Purging DHCP transaction id: 0x21F2E Lease: 0 secs, Renewal: 0 secs, Rebind: 0 secs No timer running Retry count: 0 Client-ID:

DHCP: allocate request DHCP: zapping entry in DHC_PURGING state for outside DHCP: new entry. add to queue DHCP: SDiscover attempt # 1 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0debug dhcpc packet DHCP: SDiscover attempt # 2 for entry: DHCP: SDiscover: sending 278 byte length DHCP packet DHCP: SDiscover 278 bytes DHCP Broadcast to 255.255.255.255 from 0.0.0.0 pixfirewall# pixfirewall# no debug dhcpc packet pixfirewall# debug dhcpc detail pixfirewall# DHCP: QScan: Purging entry DHCP get addr: existing ip lease str = 0xaabc64 DHCP: new ip lease str = 0xa8b434 DHCP: QScan: Purging entry DHCP: QScan: Timed out Selecting state DHCP get addr: existing ip lease str = 0xa8b434 DHCP: new ip lease str = 0xaada64 DHCP: QScan: Purging entry DHCP: QScan: Timed out Selecting state DHCP get addr: existing ip lease str = 0xaada64 DHCP: new ip lease str = 0xaadc04 DHCP: QScan: Purging entry DHCP: QScan: Timed out Selecting state DHCP get addr: existing ip lease str = 0xaadc04 DHCP: new ip lease str = 0xaadda4 DHCP: QScan: Timed out Selecting state DHCP get addr: existing ip lease str = 0xaadda4 DHCP: new ip lease str = 0xaabc64 pixfirewall# no debug dhcpc detail DHCP: QScan: Purging entry pixfirewall# reload Proceed with reload? [confirm]

Rebooting....

CISCO SYSTEMS PIX-501 Embedded BIOS Version 4.3.200 07/31/01 15:58:22.08 Compiled by morlee

16 MB RAM

PCI Device Table. Bus Dev Func VendID DevID Class Irq 00 00 00 1022 3000 Host Bridge 00 11 00 8086 1209 Ethernet 9 00 12 00 8086 1209 Ethernet 10

Cisco Secure PIX Firewall BIOS (4.2) #6: Mon Aug 27 15:09:54 PDT 2001 Platform PIX-501 Flash=E28F640J3 @ 0x3000000

Use BREAK or ESC to interrupt flash boot. Use SPACE to begin flash boot immediately. Reading 1962496 bytes of image from flash. ################################################################################ ###############################

16MB RAM mcwa i82559 Ethernet at irq 9 MAC: 0011.935f.0123 mcwa i82559 Ethernet at irq 10 MAC: 0011.935f.0124 Flash=E28F640J3 @ 0x3000000 BIOS Flash=E28F640J3 @ 0xD8000

----------------------------------------------------------------------- || || || || |||| |||| ..:||||||:..:||||||:.. c i s c o S y s t e m s Private Internet eXchange

----------------------------------------------------------------------- Cisco PIX Firewall

Cisco PIX Firewall Version 6.3(4) Licensed Features: Failover: Disabled VPN-DES: Enabled VPN-3DES-AES: Enabled Maximum Physical Interfaces: 2 Maximum Interfaces: 2 Cut-through Proxy: Enabled Guards: Enabled URL-filtering: Enabled Inside Hosts: 10 Throughput: Unlimited IKE peers: 10

This PIX has a Restricted (R) license.

****************************** Warning ******************************* Compliance with U.S. Export Laws and Regulations - Encryption.

This product performs encryption and is regulated for export by the U.S. Government.

This product is not authorized for use by persons located outside the United States and Canada that do not have prior approval from Cisco Systems, Inc. or the U.S. Government.

This product may not be exported outside the U.S. and Canada either by physical or electronic means without PRIOR approval of Cisco Systems, Inc. or the U.S. Government.

Persons outside the U.S. and Canada may not re-export, resell or transfer this product by either physical or electronic means without prior approval of Cisco Systems, Inc. or the U.S. Government. ******************************* Warning

*******************************

Copyright (c) 1996-2003 by Cisco Systems, Inc.

Restricted Rights Legend

Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706

.... Allocated IP address = 192.168.15.100, netmask = 255.255.255.0, gateway = 192.1

68.15.1 outside interface address added to PAT pool . Cryptochecksum(unchanged): cd27035e b1aaf10a 257e562b 16c8b3e2 Type help or '?' for a list of available commands. pixfirewall>

Cannot select private key pixfirewall>

-------------------------------------------------------------------------- Cordially, Lee

Reply to
Lee
Loading thread data ...

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.