PIX firewall internet problem

Uzairahmad — Sat, 23 Apr 2011 07:17:32 +0000

Hello
this is my pix firewall 515E configuration.

Password:
Type help or ‘?’ for a list of available commands.
pixfirewall> en
Password:
pixfirewall# show runn
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password
passwd
hostname pixfirewall
domain-name 192.168.0.230
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.0.144 xxx
name 192.168.0.8 xxx
name 192.168.0.11 xxx
name 192.168.0.37 xxx
name 192.168.0.41 xxx
name 192.168.0.32 xxx
object-group network net
access-list yyyyy permit ip any host 192.168.1.2
access-list yyyyy permit icmp any any
access-list yyyyy permit ip any host 192.168.0.236
access-list yyyyy permit ip any host 192.168.0.235
access-list yyyyy permit ip any host 192.168.0.230
access-list yyyyy permit ip any host 192.168.0.231
access-list yyyyy permit ip any host 192.168.0.118
access-list yyyyy permit ip any host 192.168.0.243
access-list yyyyy permit ip any host 192.168.0.121
access-list yyyyy permit ip any host 192.168.0.120
access-list yyyyy permit ip any host 192.168.0.141
access-list yyyyy permit ip any host 192.168.0.241
access-list yyyyy permit ip any host 192.168.0.242
access-list yyyyy permit ip any host 192.168.0.240
access-list yyyyy permit ip any host 192.168.0.200
access-list yyyyy permit ip any host 192.168.0.245
access-list yyyyy permit ip any host 192.168.0.4
access-list yyyyy permit ip any host 202.163.121.60
access-list yyyyy permit ip any host 202.163.121.61
access-list yyyyy permit ip any host 202.163.121.62
access-list internet deny tcp host 192.168.0.15 any eq www
access-list internet deny tcp host xxx any eq www
access-list internet deny tcp host 192.168.0.26 any eq www
access-list internet deny tcp host 192.168.0.27 any eq www
access-list internet deny tcp host xxx any eq www
access-list internet deny tcp host xxx any eq www
access-list internet deny tcp host 192.168.0.43 any eq www
access-list internet deny tcp host 192.168.0.44 any eq www
access-list internet deny tcp host 192.168.0.47 any eq www
access-list internet deny tcp host 192.168.0.48 any eq www
access-list internet deny tcp host 192.168.0.49 any eq www
access-list internet deny tcp host 192.168.0.50 any eq www
access-list internet deny tcp host 192.168.0.52 any eq www
access-list internet deny tcp host 192.168.0.53 any eq www
access-list internet deny tcp host 192.168.0.54 any eq www
access-list internet deny tcp host 192.168.0.55 any eq www
access-list internet deny tcp host 192.168.0.56 any eq www
access-list internet deny tcp host 192.168.0.57 any eq www
access-list internet deny tcp host 192.168.0.58 any eq www
access-list internet deny tcp host 192.168.0.72 any eq www
access-list internet deny tcp host 192.168.0.75 any eq www
access-list internet deny tcp host 192.168.0.76 any eq www
access-list internet deny tcp host 192.168.0.77 any eq www
access-list internet deny tcp host 192.168.0.78 any eq www
access-list internet deny tcp host 192.168.0.80 any eq www
access-list internet deny tcp host 192.168.0.81 any eq www
access-list internet deny tcp host 192.168.0.84 any eq www
access-list internet deny tcp host 192.168.0.85 any eq www
access-list internet deny tcp host 192.168.0.86 any eq www
access-list internet deny tcp host 192.168.0.87 any eq www
access-list internet deny tcp host 192.168.0.88 any eq www
access-list internet deny tcp host 192.168.0.46 any eq www
access-list internet deny tcp host 192.168.0.98 any eq www
access-list internet deny tcp host 192.168.0.74 any eq www
access-list internet deny tcp host 192.168.0.21 any eq www
access-list internet deny tcp host 192.168.0.23 any eq www
access-list internet deny tcp host 192.168.0.99 any eq www
access-list internet deny tcp host 192.168.0.100 any eq www
access-list internet deny tcp host 192.168.0.102 any eq www
access-list internet deny tcp host 192.168.0.104 any eq www
access-list internet deny tcp host 192.168.0.133 any eq www
access-list internet deny tcp host 192.168.0.134 any eq www
access-list internet deny tcp host 192.168.0.129 any eq www
access-list internet deny tcp host 192.168.0.132 any eq www
access-list internet deny tcp host 192.168.0.153 any eq www
access-list internet deny tcp host 192.168.0.154 any eq www
access-list internet deny tcp host 192.168.0.105 any eq www
access-list internet deny tcp host 192.168.0.59 any eq www
access-list internet deny tcp host 192.168.0.60 any eq www
access-list internet deny tcp host xxx any eq www
access-list internet deny tcp host xxx any eq www
access-list internet deny tcp host 192.168.0.12 any eq www
access-list internet deny tcp host 192.168.0.17 any eq www
access-list internet deny tcp host 192.168.0.24 any eq www
access-list internet deny tcp host 192.168.0.63 any eq www
access-list internet deny tcp host 192.168.0.65 any eq www
access-list internet deny tcp host 192.168.0.66 any eq www
access-list internet deny tcp host 192.168.0.67 any eq www
access-list internet deny tcp host 192.168.0.70 any eq www
access-list internet deny tcp host 192.168.0.90 any eq www
access-list internet deny tcp host 192.168.0.64 any eq www
access-list internet deny tcp host 192.168.0.94 any eq www
access-list internet deny tcp host 192.168.0.19 any eq www
access-list internet deny tcp host 192.168.0.170 any eq www
access-list internet deny tcp host 192.168.0.148 any eq www
access-list internet deny tcp host 192.168.0.183 any eq www
access-list internet deny tcp host 192.168.0.181 any eq www
access-list internet deny tcp host 192.168.0.182 any eq www
access-list internet deny tcp host 192.168.0.184 any eq www
access-list internet deny tcp host 192.168.0.185 any eq www
access-list internet deny tcp host 192.168.0.186 any eq www
access-list internet deny tcp host 192.168.0.187 any eq www
access-list internet deny tcp host 192.168.0.188 any eq www
access-list internet deny tcp host 192.168.0.189 any eq www
access-list internet deny tcp host 192.168.0.190 any eq www
access-list internet deny tcp host 192.168.0.191 any eq www
access-list internet deny tcp host 192.168.0.192 any eq www
access-list internet deny tcp host 192.168.0.193 any eq www
access-list internet deny tcp host 192.168.0.194 any eq www
access-list internet deny tcp host 192.168.0.195 any eq www
access-list internet deny tcp host 192.168.0.196 any eq www
access-list internet deny tcp host 192.168.0.197 any eq www
access-list internet deny tcp host 192.168.0.198 any eq www
access-list internet deny tcp host 192.168.0.199 any eq www
access-list internet deny tcp host 192.168.0.29 any eq www
access-list internet deny tcp host 192.168.0.30 any eq www
access-list internet deny tcp host 192.168.0.35 any eq www
access-list internet deny tcp host 192.168.0.36 any eq www
access-list internet permit ip any any
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.11
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.12
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.13
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.14
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.15
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.16
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.17
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.18
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.19
access-list 111 permit ip 192.168.0.0 255.255.255.0 host 172.16.0.20
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside (Public IP) 255.255.255.248
ip address inside 192.168.0.250 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 111 192.168.0.248
global (outside) 1 (PublicIP)
nat (inside) 0 access-list 111
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 192.168.0.230 192.168.0.230 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.231 192.168.0.231 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.236 192.168.0.236 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.235 192.168.0.235 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.243 192.168.0.243 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.121 192.168.0.121 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.240 192.168.0.240 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.200 192.168.0.200 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.245 192.168.0.245 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.4 192.168.0.4 netmask 255.255.255.255 0 0
static (inside,outside) 202.163.121.60 192.168.0.4 netmask 255.255.255.255 0 0
static (inside,outside) 202.163.121.61 192.168.0.232 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.242 192.168.0.242 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.0.241 192.168.0.241 netmask 255.255.255.255 0 0
access-group yyyyy in interface outside
access-group internet in interface inside
conduit permit icmp any any
route outside 0.0.0.0 0.0.0.0 Router Interface Public IP 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside xxxx tftp-root
floodguard enable
telnet (Public IP) 255.255.255.248 outside
telnet 192.168.0.0 255.255.255.0 inside
telnet (Router Interface IP) 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
pixfirewall#
pixfirewall#
pixfirewall#
pixfirewall#
pixfirewall#

My question is…….
i want to allow internet on this IP 192.168.0.231
How can i do so????
i have done this
no access-list yyyyy permit ip any host 192.168.0.231
and
no static (inside,outside) 192.168.0.231 192.168.0.231 netmask 255.255.255.255 0 0
but in vain
Please help me

Checking when PIX/ASA rules were accessed on a PIX 515e

ITKE — Mon, 12 Apr 2010 17:56:58 +0000

I’m a recent hire, and now I’ve been asked to clean up our PIX/ASA rules. Aside from the show access-list, is there a command that can help me determine the last time the rule was accessed? Any other tips when cleaning up rule clutter?

Combining Networks with Same IP Scheme, VLAN,

Ramii — Sun, 15 Nov 2009 16:12:07 +0000

Hi, We are combining an couple offices next week & i need some advice. The networks already have VLANs set up. we have a Cisco 3550 Layer 3 switch set up to route traffic. The servers are on this site also. The network IP’s are 10.1.1.x, 10.1.4.x & 10.1.5.x. Servers reside on all of those networks. The network they are moving to is on a 10.1.3.x network. We have a Cisco PIX 506e & 515 set up to do VPN between the 10.1.1.x & 10.1.3.x networks. I have ordered another smart switch to put on the 10.1.3.x network so i can create the same VLANs on that network. (10.1.4.x & 10.1.5.x.) Am i thinking right that i need to do this, or should i be going a different route to set up the networks & route traffice the way i need to? I really want to keep the IP Scheme that everyone is already on, but if this cannot be done, i can do something else. I did read one situation from http://itknowledgeexchange.techtarget.com/itanswers/site-to-site-problems/ but this setup is almost the same as mine without the VLANs. Any assistance is greatly appreciated.

hocan we install and configure pix 515E between proxy and modem

Intrnetworking — Fri, 21 Nov 2008 14:28:26 +0000

I have to install and configure a pix 515E firewall between the internet and LAN. Our client have 2 Mbps internet connectivity and they have a public IP also. The modem is connected to switch. That switch is connected to the device called CYBERROAM, this device is using as a proxy server.
The cyberroam has four Ethernet port. Only two ports are using presently one is connected to LAN switch and another is to WAN. In LAN port they have given a local IP address and in wan port they have a public ip. In client PSs they have installed cyberroam software and user name password for access the internet.

They are using four networks that are
10.24.0.0 /16
10.34.0.0 /16
10.44.0.0 /16
10.35.0.0 /16
Even though we can communicate with any network easily, they have made some default gateways for that.
If I am connecting pix firewall between the modem and cyberroam what are the changes I should do what are the configuration I should give for provide internet to client Pcs.

pix 515E firewall inside traffic monitoring and controll

Techartist — Sat, 09 Feb 2008 10:47:50 +0000

first of all thanks Mr. Layer9 for ur such a nice and helpful participation in this question. by reading all his i also got some questions in mind to ask from you. i hope u will please me…
i have pix firewall 515e with cisco router 2600 series, infact i wana do two tasks on it, first that how can i stop maximum p2p connections through it and second that how can i monitor my inside interface users through it. is it possible that i can use a transperant proxy (squid) through it, in your previous mentioned answer you said that one can restrict inside users to a proxy address by changging the value oh nat ( inside ) 0 0 to your proxy address, but when i consoled my pix i saw some thing different like nat (inside) 1 0.0.0.0 0.0.0.0 0 0
so how can i do and plz explain above command as well. thanks

IT Answers » PIX 515E

PIX firewall internet problem

Checking when PIX/ASA rules were accessed on a PIX 515e

Combining Networks with Same IP Scheme, VLAN,

hocan we install and configure pix 515E between proxy and modem

pix 515E firewall inside traffic monitoring and controll