1. Home
  2. Cisco Systems
  3. Problem w/ Cisco PIX 506 and web server

Problem w/ Cisco PIX 506 and web server

I have a Cisco PIX 506 (v6.3) on a very simple, small office network. I've managed to get the email server to work fine behind the pix, and even got VPN to work, as well as NAT for inside workstations to access the internet. For now I have a web server in front of the PIX, and it can sucessfully connect to a SQL server behind the PIX. Obviously, I really need to get this webserver behind the PIX, but I can't find whats wrong. Any help would be greatly appreciated. Here is a fragment of our config (prefix IPs ommitted):

interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 access-list 100 permit icmp any any echo-reply access-list 100 permit icmp any any time-exceeded access-list 100 permit icmp any any unreachable access-list 100 permit tcp any host X.Y.78.211 eq smtp access-list 100 permit tcp any host X.Y.78.211 eq pop3 access-list 100 permit tcp any host X.Y.78.212 eq 1433 access-list 100 permit tcp any host X.Y.78.210 eq www access-list 101 permit ip 10.10.2.0 255.255.255.0 172.16.1.0

255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside X.Y.78.221 255.255.255.128 ip address inside 10.10.2.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool ippool 172.16.1.1-172.16.1.254 pdm history enable arp timeout 14400 global (outside) 1 X.Y.78.222 nat (inside) 0 access-list 101 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) X.Y.78.211 10.10.2.3 netmask 255.255.255.255 0 0 static (inside,outside) X.Y.78.212 10.10.2.4 netmask 255.255.255.255 0 0 static (inside,outside) X.Y.78.210 10.10.2.5 netmask 255.255.255.255 0 0 access-group 100 in interface outside route outside 0.0.0.0 0.0.0.0 X.Y.78.129 1

So basically, the X.Y.78.210 is our public webserver ip, and inside it should be 10.10.2.5. But, for some reason the webserver has no internet access when inside. It has access to the LAN, but nothing on the outside. And so naturally, nothing to point to it from the outside. The domain registrar has the domain properly pointing to that public ip, and if I place the web server outside from the PIX, it works great.

Any ideas? Comments? I'd really appreciate any input, thanks!

-J

Reply to
Japhar
Loading thread data ...

In article , Japhar wrote: :I have a Cisco PIX 506 (v6.3)

:access-list 100 permit icmp any any echo-reply :access-list 100 permit icmp any any time-exceeded :access-list 100 permit icmp any any unreachable :access-list 100 permit tcp any host X.Y.78.211 eq smtp :access-list 100 permit tcp any host X.Y.78.211 eq pop3 :access-list 100 permit tcp any host X.Y.78.212 eq 1433 :access-list 100 permit tcp any host X.Y.78.210 eq www

Try adding

access-list 100 permit udp any eq dns host X.Y.78.210

so that returning DNS queries can be processed.

The PIX -does- automatically open up UDP channels back, but since UDP is connectionless it can't doesn't always work perfectly.

:So basically, the X.Y.78.210 is our public webserver ip, and inside it :should be 10.10.2.5. But, for some reason the webserver has no internet :access when inside. It has access to the LAN, but nothing on the :outside.

No access? No ability to ping something outside by IP ? DNS problem or default gateway problem, perhaps.

Reply to
Walter Roberson

Thanks for the quick reply. I'll try adding the DNS permissions. As for the web server getting outside access, no nothing works. Even when I try to ping an outside IP (vs a domain name) it simply doesn't work. And its not the machine, because if I set a workstation to be

10.10.2.5, and place it behind the PIX with the same config, the same thing happens. If I remove the static entry for 10.10.2.5 and clear the xlate, it can ping the outside.

Its baffling, that static line somehow is responcible for not allowing any connection to the outside.

-J

Walter Robers> > :I have a Cisco PIX 506 (v6.3)

internet

Reply to
Japhar

In article , Japhar wrote: :As for :the web server getting outside access, no nothing works. Even when I :try to ping an outside IP (vs a domain name) it simply doesn't work. :And its not the machine, because if I set a workstation to be :10.10.2.5, and place it behind the PIX with the same config, the same :thing happens. If I remove the static entry for 10.10.2.5 and clear the :xlate, it can ping the outside.

That's a good test, and it is good that you thought to clear the xlate.

Your config was a fragment. In the part that wasn't shown, do you happen to have configured the sysopt that turns off proxy arp?

When the device is active at .210 and tries to go out, does the router have an entry for it in its arp tables?

If you debug icmp trace and try to ping outwards by IP, is the packet shown as going out? Does anything return in response?

Try this as well. In configure mode,

access-list test210 permit ip host 10.10.2.5 any access-list test210 permit ip host X.Y.7.210 any access-list test210 permit ip any host 10.10.2.5 access-list test210 permit ip any host X.Y.7.210

Then this can be done either in or out of configure mode:

capture c210in access-list test210 interface inside capture c210out access-list test210 interface outside

then try a test, then

show capture c210in show capture c210out

When you are done with the captures, you can

no capture c210in no capture c210out

My working hypothesis at the moment is that for some reason proxy arp is not working for you and that possibly the router does not know to route .210 through the PIX outside IP. (It's safer to set your router to always route the entire block through the PIX outside IP, in case proxy arp breaks.)

Reply to
Walter Roberson

Thanks for the info! Ok, you're going to think I'm stupid but, we don't have a router in this setup. Right now we have the cable modem going straight to the pix, and from the pix to our switch/LAN.

As for sysopt, the only sysopt command I have is for our vpn: sysopt connection permit-ipsec

I tried adding those access-list rules, but I still couldn't get any ping to the outside, and the captures didn't make much sense to me :(

again thanks, J

Reply to
Japhar

In article , Japhar wrote: :Right now we have the cable modem going :straight to the pix, and from the pix to our switch/LAN.

Sometimes cable modems are routers, and sometimes they are bridges.

Either one should work, especially as I note that your 'global' IP is not the same as your interface IP -- if it works for one it should work for others in the same subnet.

:the captures didn't make much sense to me :(

If you add the word 'detail' after the "show capture" line then it will give some more information. If you post a very short selection then we can have a look. Longer selections are best done out of band (e.g., a URL). Note there is a 'copy' command to copy the traces to a tftp server: the traces can then be examined in detail with tools such as 'tcpdump'.

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.