PIX 515 DMZ can't access Internet

Whatever the next hop is beyond your PIX: does it know to *route*

The PIX will proxy arp for 209.181.x.y, but proxy arp is often unreliable.

Thanks Walter...

The PIX 515 is part of the DSL set up, behind a Cisco 837 DSL router. Range of 8 ip addresses (6 usable) from DSL provider.

Are you suggesting I need to look into the config of the Cisco 837? If you are, what am I looking for in particular?

Thanks again.

BV

Just wondering if the x.y address is in the range of 6 represented by a.b? Don't you have to exclude the address used for the static translation from the pool?

John

No, static() overrides nat/global (except nat 0 access-list).

.0 - base address .7 - broadcast address .something - 837's LAN address

That's the minimum usable setup if your IP address range is brought to you on a "carrier" IP range. But if your IP address range is direct, then you have

.something - 837's WAN address .somethingelse - ISP's WAN address

leaving only 4 usable IPs (unless you overload the 837's WAN addres sto forward to something internal.)

In any case, on the 837, you would put something like

route inside 290.181.x.0 0.0.0.7 host 209.181.a.b

replacing 290.181.x.0 with the base IP address of your range.

In my Cisco 837 DSL router there is an entry relating to routing:

"ip route 0.0.0.0 0.0.0.0 Dialer0"

Dialer0 is "ip unnumbered Ethernet0" and Ethernet0 is assign the WAN IP, which is another IP address (different from both 209.181.x.y and

The above ip route command should be sufficient... right?

BV