We have a PIX515e setup where we are using NAT for our internal hosts.
inside-network is 192.168.7.zzz/24
outside network is 194.xxx.yyy.zzz/24
where zzz in the inside and outside are exactly the same
The issue we are facing is that, our machines on the internal interface can at times talk to each other and at times cannot. Pinging in almost all cases is dropping packets, Remote desktop into another host works and then disconnects, but also that we have DNS servers which cant communicate to each other.
If you have any ideas, please let me know. Bear in mind that there is communication but there is major packet drops and loss of communication after connection.
We have 4 rules on the inside interface allowing ip, tcp, udp and icmp from ANY to ANY on the inside interface. Although these rules are not exaclty needed as the firewall is setup to block all inbound traffic except for specific inbound rules, we created them to ensure connectivity, but no luck!!
Thanks in advance
I have to agree with Eddie--traffic between 2 hosts on the same subnet will not be affected by the firewall's rule set.
Given the intermittent success of the connection, I would start by checking the cables and NICs and swapping them out with known good ones. If the problem persists, try collecting packet captures on the hosts at each end of the connection using Wireshark or tcpdump. You should see something along these lines:
1. Source host sends an ARP request for the MAC address that corresponds to the destination IP address.
2. Destination host sends an ARP reply with its MAC address.
3. Source host starts sending traffic to the correct IP and MAC address
4. Destination host acknowledges/replies with more traffic to the source host using the correct IP and MAC address.
You should see that the traffic is identical on both ends of the connection (including MAC addresses since it never leaves the subnet). If any of the steps are missing, or the traffic does not match on both ends, that should give you an idea of where to start troubleshooting this issue.
Also, as Eddie mentioned, you should check the switch to make sure the error counters are not increasing. Even with a new switch, errors can be caused by anything from bad cables to speed/duplex mismatches.
Hope that helps.
That is strange. Is the default gateway for all hosts the inside interface of the firewall?