Jon Marshall Mon, 07/30/2007 - 23:03
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


You are not missing anything. The pix will not allow you to ping a "remote" interface ie. you can ping the inside interface from the inside, you can ping the outside interface from the outside. But you can't ping the inside interface from outside and the outside from inside.


Note with pix v7.x you can allow this by using the command


managment-access inside


HTH


Jon


purohit_810 Tue, 07/31/2007 - 12:31
User Badges:
  • Silver, 250 points or more

Hi,


If you would open PING (ICMP) follow the process:


static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0


!--- and either


conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo


!--- or


access-list 101 permit icmp any host 192.168.1.5 echo

access-group 101 in interface outside


PING from Outbound:


static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0


!--- and either


conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded


!--- or


access-list 101 permit icmp any host 192.168.1.5 echo-reply

access-list 101 permit icmp any host 192.168.1.5 source-quench

access-list 101 permit icmp any host 192.168.1.5 unreachable

access-list 101 permit icmp any host 192.168.1.5 time-exceeded

access-group 101 in interface outside



More troubleshoting steps you can find from URL:


http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml



Regards,

Dharmesh Purohit

dragec Tue, 07/31/2007 - 20:56
User Badges:

I do not have problem with pinging hosts. I have problem with pinging fw interfaces.

Hi there,


If you were in the inside segment you can't ping the pix outside interface or DMZ. That's a pix thing. You can however, ping the interfaces (inside, outside, dmz, etc..) from the respective segment. For example, machines on the outside should be able to ping the PIX outside interface but will not be able to ping the PIX inside interface (assuming you have not blocked icmp on the pix interface). Machines in the inside can't ping pix outside interface but can ping inside interface. Think of it as you only can ping adjacent PIX interface only and not other ping interfaces. But you should be able to ping all other hosts in different zones assuming the proper security policy is applied.

Hope this helps.


Amin


Actions

This Discussion