07-30-2007 10:36 PM - edited 03-11-2019 03:51 AM
I cannot ping external interface of pix from inside. Access list permits this traffic. I cannot find anything in logs. What is missing?
07-30-2007 11:03 PM
Hi
You are not missing anything. The pix will not allow you to ping a "remote" interface ie. you can ping the inside interface from the inside, you can ping the outside interface from the outside. But you can't ping the inside interface from outside and the outside from inside.
Note with pix v7.x you can allow this by using the command
managment-access inside
HTH
Jon
07-31-2007 12:31 PM
Hi,
If you would open PING (ICMP) follow the process:
static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0
!--- and either
conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo
!--- or
access-list 101 permit icmp any host 192.168.1.5 echo
access-group 101 in interface outside
PING from Outbound:
static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0
!--- and either
conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply
conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench
conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable
conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded
!--- or
access-list 101 permit icmp any host 192.168.1.5 echo-reply
access-list 101 permit icmp any host 192.168.1.5 source-quench
access-list 101 permit icmp any host 192.168.1.5 unreachable
access-list 101 permit icmp any host 192.168.1.5 time-exceeded
access-group 101 in interface outside
More troubleshoting steps you can find from URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
Regards,
Dharmesh Purohit
07-31-2007 08:56 PM
I do not have problem with pinging hosts. I have problem with pinging fw interfaces.
08-02-2007 01:32 PM
Hi there,
If you were in the inside segment you can't ping the pix outside interface or DMZ. That's a pix thing. You can however, ping the interfaces (inside, outside, dmz, etc..) from the respective segment. For example, machines on the outside should be able to ping the PIX outside interface but will not be able to ping the PIX inside interface (assuming you have not blocked icmp on the pix interface). Machines in the inside can't ping pix outside interface but can ping inside interface. Think of it as you only can ping adjacent PIX interface only and not other ping interfaces. But you should be able to ping all other hosts in different zones assuming the proper security policy is applied.
Hope this helps.
Amin
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide