I was able to pick up a pix515e for my home network, I've got it running Version 8.0(4)28 and Device manager version 6.1(3) which I think are the latest that it will support with its 64Ram/16Flash.

My network is configured as follows:

ISP gateway is

I have the outside as 192.

I have the dmz as 172.

I have the inside as 10.

the problem i'm having is from the inside I cant do DNS lookkups. I can get to external hosts. I can ping however dns doesn't work, nslookups to the same address time out. (commands work from the outside network)

when I do a show service-policy

Global policy:
  Service-policy: global_policy
    Class-map: inspection_default
      Inspect: dns preset_dns_map, packet 135, drop 0, reset-drop 0

It doesn't show any drops, though I'm not sure that's relevant.

this is the full configuration:

PIX Version 8.0(4)28
hostname pix515e
domain-name MyDomain.com
enable password fTSmleTIquYwO4vv encrypted
passwd 2KFNnbNIdI.4KYOU encrypted
interface Ethernet0
 nameif outside
 security-level 0
 ip address
interface Ethernet1
 nameif inside
 security-level 100
 ip address
interface Ethernet2
 nameif dmz
 security-level 50
 ip address
ftp mode passive
dns server-group DefaultDNS
 domain-name MyDomain.com
access-list outside-in-acl remark Allow ICMP Type 11 for Windows tracert
access-list outside-in-acl extended permit icmp any any time-exceeded
access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any source-quench
access-list 101 extended permit icmp any any unreachable
access-list 101 extended permit icmp any any time-exceeded
access-list 101 extended permit icmp any any echo
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 10 burst-size 5
asdm image flash:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1
access-group 101 in interface inside
access-group 101 in interface outside
access-group 101 in interface dmz
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect icmp
 class class-default
  set connection decrement-ttl
service-policy global_policy global
prompt hostname context

I haven't messed around with a PIX in years, so I've ive made other errors besides the dns configuration please point them out :)

  • 3
    I don't see where ACL 101 permits DNS; perhaps I am missing the obvious since I am reading this on my phone.
    – This
    Jun 12 '14 at 1:51
  • That was it! I knew it was something simple, thanks so much.
    – FrozenSoul
    Jun 12 '14 at 2:11

Promoting my comment to an answer so the Community user won't perpetually bump the question. Please configure acl 101 to permit dns.

policy-map type inspect dns preset_dns_map
  message-length maximum 512

That's a very stupid default on Cisco's part, and has long been the source of many headaches. I'd strongly recommend removing that policy. (the instant a query/answer exceeds 512 bytes, you'll wish you did.)

policy-map global_policy
 class inspection_default
  no inspect dns preset_dns_map
no policy-map type inspect dns preset_dns_map

(that's the equiv of no fixup dns)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.