我们为客户配置 cisco防火墙，配置后外网能够PING通WEB服务器，但是局域网内部用户无法登陆WEB服务器，那位高手帮忙解决一下！！先谢了！！

配置？版本？拓扑？具体的需求？给一下～！

这是防火墙的配置，帮忙给看看！问题就是内部网无法浏览WEB服务器上的主页，但外部网可以！大侠拜托！！
pixfirewall#
pixfirewall#
pixfirewall# sh run
: Saved
:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password 8itTaeSI2dqCeqfp encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 101 permit icmp any any
access-list 101 permit tcp any host 211.102.98.233 eq www
access-list 101 permit tcp any host 211.102.98.232 eq www
<--- More ---> pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 211.102.98.236 255.255.255.240
ip address inside 192.168.111.1 255.255.255.0
ip address dmz 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 211.102.98.230 netmask 255.255.255.240
nat (inside) 1 192.168.111.0 255.255.255.0 0 0
static (inside,outside) 211.102.98.233 192.168.111.2 netmask 255.255.255.255 0 0
static (inside,outside) 211.102.98.232 192.168.111.3 netmask 255.255.255.255 0 0
access-group 101 in interface outside
conduit permit tcp host 211.102.98.232 eq www any
conduit permit tcp host 211.102.98.233 eq www any
route outside 0.0.0.0 0.0.0.0 211.102.98.225 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
<--- More ---> timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:376e89b41b1fbceebec8a1c27bd04e89
: end
pixfirewall#
pixfirewall#
pixfirewall# s h conduit
conduit permit tcp host 211.102.98.232 eq www any (hitcnt=0)
conduit permit tcp host 211.102.98.233 eq www any (hitcnt=0)
pixfirewall#
pixfirewall#
pixfirewall#

偶没有做过PIX的防火墙
但感觉应该是透明连接配置的问题
就是内网和DMZ的访问配置

因为你的WEB是放在inside一侧的，而它的IP地址为192.168.111.2，3的地址，而内部网络用户得到的解析地址为：211.102.98.233，232，
而PIX是不支持这种从内到外在到内的这种NAT的，所以内部可户将不能访问到你的WEB网站了。因此你需要在内部做一个DNS服务器才可以保证正常访问，或者是在内部机器上的hosts文件内加入你需要的解析，解析到你的内部IP地址了。