Rank: Member Groups: Member
Joined: 2/16/2008 Posts: 29 Points: 87 Location: Seattle, Washington
|
I use Charter Internet with a 13 pack of static IP addresses. The cable from Charter connects to an Ambit cable modem which is connected directly to my Cisco PIX firewall. There are four static translations in the PIX (two name servers and two web servers). All worked perfect until recently when Charter swapped out my original Ambit cable modem with a new model Ambit cable modem (U10C020). When powering everything up from scratch, only the device related to the first static translation can be seen from the Internet side. The other three devices with static translations cannot. If I force any of the other three connections open by establishing an outbound session, they will work only until the arp table entry in the new Ambit times out. Then they cannot be brought up from the Internet side. The first static translation will stay up indefinitely unless something causes the arp entry in the cable modem to time out (like a brief power outage). Then it cannot be brought up from the Internet side unless I do clear xlate in the PIX or reboot the name/web server or reload the PIX. The PIX is a 515E running 6.3(1). In summary, with the old cable modem everything worked as it should. With the new cable modem, access to my name/web servers from the Internet is unreliable. Connecting a PC to one of the Ethernet ports on the cable modem reveals that the PIX seems to be behaving correctly in all respects. Charter Internet has been unable/unwilling to effect a solution saying basically that I'm on my own. Final summary, with the new Ambit modem the four devices inside the PIX (with four static translations and appropriate conduits) cannot be reliably seen from the Internet. At the same time they can be seen from a PC connected directly to the cable modem on the outside of the PIX.
|
 Rank: Member Groups: Member
Joined: 2/16/2008 Posts: 14 Points: 42 Location: Des Moines, IA
|
it appears that your ISP is not providing the proper routing for your other IP addresses. From a different location, do a traceroute and see if all the IPs terminate at the same location.
Are you able to see the outside interface of the firewall from the Internet?
Are you able to manage the new cable router?
|