PIX no route

The information you provide is not sufficient. A more complete configuration would help.

Regards, Christoph Gartmann

Here goes:

PIX Version 6.2(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security50 nameif ethernet3 DMZ2 security15 nameif ethernet4 DMZ3 security20 nameif ethernet5 intf5 security25 enable password mS5qbo9l.H.1Oo6b encrypted passwd mS5qbo9l.H.1Oo6b encrypted hostname pixfirewall fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 names name 172.172.0.26 PC4 name 192.168.1.11 PC1 name 172.172.0.171 PC2 name 192.168.1.10 PC5 name 192.168.1.15 PC3 name 172.172.12.4 ITP_1 name 172.172.11.252 ITP_2 name 172.172.12.92 ITP_3 name 172.172.12.102 ITP_4 name 172.172.12.91 ITP_5 name 172.172.12.16 ITP_6 name 10.197.22.151 ITP_7 object-group network ITPgroup network-object ITP_7 255.255.255.255 network-object ITP_1 255.255.255.255 object-group network DNS_Lookup network-object PC3 255.255.255.255 network-object host SDNISA01 network-object Laurel 255.255.255.255 network-object SDNEDC02 255.255.255.255 object-group network HTTP_access network-object PC3 255.255.255.255 network-object ITP_1 255.255.255.255 network-object ITP_2 255.255.255.255 network-object ITP_3 255.255.255.255 object-group network HTTPS_access network-object PC3 255.255.255.255 network-object ITP_1 255.255.255.255 network-object ITP_2 255.255.255.255 network-object ITP_3 255.255.255.255 object-group network DMZ_Network network-object 192.168.1.0 255.255.255.0 object-group network Inside_Network network-object 172.172.0.0 255.255.0.0 object-group network mainnet network-object 172.172.0.0 255.255.0.0 object-group network DMZ2_Network network-object 10.196.128.0 255.255.240.0 object-group network DMZ3_Network network-object 10.197.20.0 255.255.252.0 access-list 102 permit ip any any access-list no-nat permit ip 10.197.20.0 255.255.252.0 192.168.1.0

255.255.255.0 access-list no-nat permit ip 10.196.128.0 255.255.240.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.172.0.0 255.255.0.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.21.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.21.112.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 192.168.6.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 10.197.18.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list DMZ_inside permit tcp any any access-list DMZ_inside permit icmp any any access-list DMZ_inside permit ip any any access-list DMZ_inside permit tcp any object-group DMZ_Network eq www access-list DMZ_inside permit tcp any 192.168.1.0 255.255.255.0 eq www access-list DMZ_inside permit icmp any object-group Inside_Network access-list DMZ_inside permit icmp any host 191.101.101.29 access-list DMZ_inside permit tcp any host 191.101.101.29 access-list DMZ_inside permit tcp any host 191.101.101.29 eq www access-list DMZ_inside permit tcp any host 191.101.101.30 eq www access-list outside-in permit tcp any object-group DMZ_Network eq www access-list outside-in permit tcp any object-group DMZ_Network eq https access-list outside-in permit icmp any object-group Inside_Network access-list outside-in permit icmp any any access-list outside-in permit tcp any host TOPPC access-list outside-in permit icmp any host TOPPC access-list outside-in permit icmp any host TOPPC echo access-list outside-in permit icmp any host TOPPC echo-reply access-list outside-in permit tcp any host PC3 access-list outside-in permit icmp any host PC3 access-list outside-in permit icmp any host PC3 echo access-list outside-in permit icmp any host PC3 echo-reply access-list outside-in permit icmp any host 191.101.101.30 echo access-list outside-in permit icmp any host 191.101.101.29 echo access-list outside-in permit icmp any host 191.101.101.30 echo-reply access-list outside-in permit icmp any host 191.101.101.29 echo-reply access-list outside-in permit icmp any host 191.101.101.30 access-list outside-in permit icmp any host 191.101.101.29 access-list outside-in permit tcp any host 191.101.101.29 access-list outside-in permit tcp any host 191.101.101.29 eq www access-list outside-in permit tcp any host 191.101.101.30 eq www access-list outside-in permit tcp any host 191.101.101.30 access-list inside-out permit ip any any access-list inside-out permit icmp object-group Inside_Network object-group DMZ_Network echo-reply access-list inside-out permit ip object-group Inside_Network object-group DMZ_Network access-list inside-out permit icmp object-group Inside_Network object-group DMZ_Network echo access-list inside-out permit ip 10.197.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 10.196.128.0 255.255.240.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.172.0.0 255.255.0.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.21.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.21.112.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 192.168.6.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 10.197.18.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list inside-out permit icmp any any pager lines 24 logging on logging buffered debugging interface ethernet0 100full interface ethernet1 100full interface ethernet2 100full interface ethernet3 auto shutdown interface ethernet4 auto shutdown interface ethernet5 auto shutdown mtu outside 1500 mtu inside 1500 mtu DMZ 1500 mtu DMZ2 1500 mtu DMZ3 1500 mtu intf5 1500 ip address outside 191.101.101.2 255.255.255.240 ip address inside 172.172.0.25 255.255.0.0 ip address DMZ 192.168.1.1 255.255.255.0 ip address DMZ2 127.0.0.2 255.255.255.255 ip address DMZ3 127.0.0.3 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 ip audit info action alarm ip audit attack action alarm ip local pool vpnpool2 172.172.220.100-172.172.220.199 no failover failover timeout 0:00:00 failover poll 15 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address DMZ 0.0.0.0 failover ip address DMZ2 0.0.0.0 failover ip address DMZ3 0.0.0.0 failover ip address intf5 0.0.0.0 pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 191.101.101.17-191.101.101.18 netmask 255.255.255.240 global (outside) 1 191.101.101.19 netmask 255.255.255.240 global (DMZ) 1 192.168.1.240 netmask 255.255.255.0 nat (inside) 0 access-list no-nat nat (inside) 1 172.172.0.0 255.255.0.0 0 0 nat (inside) 1 172.21.0.0 255.255.0.0 0 0 nat (inside) 1 192.168.0.0 255.255.0.0 0 0 nat (inside) 1 10.0.0.0 255.0.0.0 0 0 static (inside,outside) 191.101.101.28 192.168.1.13 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.27 PC111 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.26 ITPC12 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.24 TOPPC netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.23 10.197.20.70 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.30 PC3 netmask 255.255.255.255 0 0 static (DMZ,inside) PC4 192.168.1.26 netmask 255.255.255.255 0 0 static (DMZ,inside) PC2 192.168.1.171 netmask 255.255.255.255 0 0 static (DMZ,outside) 191.101.101.30 PC3 netmask 255.255.255.255 0 0 static (DMZ,outside) 191.101.101.29 PC1 netmask 255.255.255.255 0 0 access-group outside-in in interface outside access-group inside-out in interface inside access-group DMZ_inside in interface DMZ route outside 0.0.0.0 0.0.0.0 191.101.101.1 1 route inside 10.196.128.0 255.255.240.0 172.172.0.254 1 route inside 10.197.18.0 255.255.255.0 172.172.0.254 1 route inside 10.197.20.0 255.255.252.0 172.172.0.254 1 route inside 172.172.0.16 255.255.255.255 172.172.0.25 1 route inside 172.21.20.0 255.255.252.0 172.172.0.254 1 route inside 172.21.112.0 255.255.252.0 172.172.0.254 1 route inside 192.168.6.0 255.255.255.0 172.172.0.254 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local aaa-server VPN-XAUTH protocol tacacs+ http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet 172.172.0.0 255.255.0.0 inside telnet timeout 5 ssh timeout 5 dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside username Roger password qJsR6GUC/Ip0aGtw encrypted privilege 2 terminal width 80 Cryptochecksum:83bc964ccd33544ad7aee2f5d7856a1b : end pixfirewall(config)#

Here goes:

PIX Version 6.2(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security50 nameif ethernet3 DMZ2 security15 nameif ethernet4 DMZ3 security20 nameif ethernet5 intf5 security25 enable password mS5qbo9l.H.1Oo6b encrypted passwd mS5qbo9l.H.1Oo6b encrypted hostname pixfirewall fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 names name 172.172.0.26 PC4 name 192.168.1.11 PC1 name 172.172.0.171 PC2 name 192.168.1.10 PC5 name 192.168.1.15 PC3 name 172.172.12.4 ITP_1 name 172.172.11.252 ITP_2 name 172.172.12.92 ITP_3 name 172.172.12.102 ITP_4 name 172.172.12.91 ITP_5 name 172.172.12.16 ITP_6 name 10.197.22.151 ITP_7 object-group network ITPgroup network-object ITP_7 255.255.255.255 network-object ITP_1 255.255.255.255 object-group network DNS_Lookup network-object PC3 255.255.255.255 network-object host SDNISA01 network-object Laurel 255.255.255.255 network-object SDNEDC02 255.255.255.255 object-group network HTTP_access network-object PC3 255.255.255.255 network-object ITP_1 255.255.255.255 network-object ITP_2 255.255.255.255 network-object ITP_3 255.255.255.255 object-group network HTTPS_access network-object PC3 255.255.255.255 network-object ITP_1 255.255.255.255 network-object ITP_2 255.255.255.255 network-object ITP_3 255.255.255.255 object-group network DMZ_Network network-object 192.168.1.0 255.255.255.0 object-group network Inside_Network network-object 172.172.0.0 255.255.0.0 object-group network mainnet network-object 172.172.0.0 255.255.0.0 object-group network DMZ2_Network network-object 10.196.128.0 255.255.240.0 object-group network DMZ3_Network network-object 10.197.20.0 255.255.252.0 access-list 102 permit ip any any access-list no-nat permit ip 10.197.20.0 255.255.252.0 192.168.1.0

255.255.255.0 access-list no-nat permit ip 10.196.128.0 255.255.240.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.172.0.0 255.255.0.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.21.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 172.21.112.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 192.168.6.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list no-nat permit ip 10.197.18.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list DMZ_inside permit tcp any any access-list DMZ_inside permit icmp any any access-list DMZ_inside permit ip any any access-list DMZ_inside permit tcp any object-group DMZ_Network eq www access-list DMZ_inside permit tcp any 192.168.1.0 255.255.255.0 eq www access-list DMZ_inside permit icmp any object-group Inside_Network access-list DMZ_inside permit icmp any host 191.101.101.29 access-list DMZ_inside permit tcp any host 191.101.101.29 access-list DMZ_inside permit tcp any host 191.101.101.29 eq www access-list DMZ_inside permit tcp any host 191.101.101.30 eq www access-list outside-in permit tcp any object-group DMZ_Network eq www access-list outside-in permit tcp any object-group DMZ_Network eq https access-list outside-in permit icmp any object-group Inside_Network access-list outside-in permit icmp any any access-list outside-in permit tcp any host TOPPC access-list outside-in permit icmp any host TOPPC access-list outside-in permit icmp any host TOPPC echo access-list outside-in permit icmp any host TOPPC echo-reply access-list outside-in permit tcp any host PC3 access-list outside-in permit icmp any host PC3 access-list outside-in permit icmp any host PC3 echo access-list outside-in permit icmp any host PC3 echo-reply access-list outside-in permit icmp any host 191.101.101.30 echo access-list outside-in permit icmp any host 191.101.101.29 echo access-list outside-in permit icmp any host 191.101.101.30 echo-reply access-list outside-in permit icmp any host 191.101.101.29 echo-reply access-list outside-in permit icmp any host 191.101.101.30 access-list outside-in permit icmp any host 191.101.101.29 access-list outside-in permit tcp any host 191.101.101.29 access-list outside-in permit tcp any host 191.101.101.29 eq www access-list outside-in permit tcp any host 191.101.101.30 eq www access-list outside-in permit tcp any host 191.101.101.30 access-list inside-out permit ip any any access-list inside-out permit icmp object-group Inside_Network object-group DMZ_Network echo-reply access-list inside-out permit ip object-group Inside_Network object-group DMZ_Network access-list inside-out permit icmp object-group Inside_Network object-group DMZ_Network echo access-list inside-out permit ip 10.197.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 10.196.128.0 255.255.240.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.172.0.0 255.255.0.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.21.20.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 172.21.112.0 255.255.252.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 192.168.6.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list inside-out permit ip 10.197.18.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list inside-out permit icmp any any pager lines 24 logging on logging buffered debugging interface ethernet0 100full interface ethernet1 100full interface ethernet2 100full interface ethernet3 auto shutdown interface ethernet4 auto shutdown interface ethernet5 auto shutdown mtu outside 1500 mtu inside 1500 mtu DMZ 1500 mtu DMZ2 1500 mtu DMZ3 1500 mtu intf5 1500 ip address outside 191.101.101.2 255.255.255.240 ip address inside 172.172.0.25 255.255.0.0 ip address DMZ 192.168.1.1 255.255.255.0 ip address DMZ2 127.0.0.2 255.255.255.255 ip address DMZ3 127.0.0.3 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 ip audit info action alarm ip audit attack action alarm ip local pool vpnpool2 172.172.220.100-172.172.220.199 no failover failover timeout 0:00:00 failover poll 15 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address DMZ 0.0.0.0 failover ip address DMZ2 0.0.0.0 failover ip address DMZ3 0.0.0.0 failover ip address intf5 0.0.0.0 pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 191.101.101.17-191.101.101.18 netmask 255.255.255.240 global (outside) 1 191.101.101.19 netmask 255.255.255.240 global (DMZ) 1 192.168.1.240 netmask 255.255.255.0 nat (inside) 0 access-list no-nat nat (inside) 1 172.172.0.0 255.255.0.0 0 0 nat (inside) 1 172.21.0.0 255.255.0.0 0 0 nat (inside) 1 192.168.0.0 255.255.0.0 0 0 nat (inside) 1 10.0.0.0 255.0.0.0 0 0 static (inside,outside) 191.101.101.28 192.168.1.13 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.27 PC111 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.26 ITPC12 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.24 TOPPC netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.23 10.197.20.70 netmask 255.255.255.255 0 0 static (inside,outside) 191.101.101.30 PC3 netmask 255.255.255.255 0 0 static (DMZ,inside) PC4 192.168.1.26 netmask 255.255.255.255 0 0 static (DMZ,inside) PC2 192.168.1.171 netmask 255.255.255.255 0 0 static (DMZ,outside) 191.101.101.30 PC3 netmask 255.255.255.255 0 0 static (DMZ,outside) 191.101.101.29 PC1 netmask 255.255.255.255 0 0 access-group outside-in in interface outside access-group inside-out in interface inside access-group DMZ_inside in interface DMZ route outside 0.0.0.0 0.0.0.0 191.101.101.1 1 route inside 10.196.128.0 255.255.240.0 172.172.0.254 1 route inside 10.197.18.0 255.255.255.0 172.172.0.254 1 route inside 10.197.20.0 255.255.252.0 172.172.0.254 1 route inside 172.172.0.16 255.255.255.255 172.172.0.25 1 route inside 172.21.20.0 255.255.252.0 172.172.0.254 1 route inside 172.21.112.0 255.255.252.0 172.172.0.254 1 route inside 192.168.6.0 255.255.255.0 172.172.0.254 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local aaa-server VPN-XAUTH protocol tacacs+ http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable telnet 172.172.0.0 255.255.0.0 inside telnet timeout 5 ssh timeout 5 dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside username Roger password qJsR6GUC/Ip0aGtw encrypted privilege 2 terminal width 80 Cryptochecksum:83bc964ccd33544ad7aee2f5d7856a1b : end pixfirewall(config)#

You shouldn't post passwords with your configuration. Although they are encrypted, there are tools available to decrypt them.

Next, I can't find a statement like the following:

Regards, Christoph Gartmann

Hi Christoph,

Yes the static is there...

static (DMZ,outside) 191.101.101.30 PC3 netmask 255.255.255.255 0 0 static (DMZ,outside) 191.101.101.29 PC1 netmask 255.255.255.255 0 0

in the names section PC1 = 192.168.1.101 and PC3 = 192.168.1.115 (I have changed some of the addresses around for obvious reasons)

Please quote context. Please see here for information on how to do so from Google Groups:

No, in the names section PC1 = 192.168.1.11 and PC3 = 192.168.1.15 . The message you quoted in your original was against 192.168.1.101 .

Now we are left uncertain as to whether you've munged inconsistantly (and why bother to do so for RFC1918 private addresses?) or if you made a mistake in your testing or configuration...