cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
912
Views
0
Helpful
3
Replies

Can't ping FWSM with Basic Configuration

Leo Laohoo
Hall of Fame
Hall of Fame

Hi,

We just installed our new FWSM and attempted to upgrade ASDM. From the 6500, we can session into the FWSM but we CAN'T ping to it. Can anyone point out our configuration mistakes?

6500 running 12.2(33)SXH4:

<font face="courier">

interface vlan 400

ip address 10.4.4.3 255.255.255.248

no shutdown

</font>

FWSM:

<font face="courier">

hostname FWSM

names

!

interface Vlan400

nameif inside

security-level 0

ip address 10.4.4.1 255.255.255.248

!

ftp mode passive

access-list inside extended permit ip any any

pager lines 24

mtu inside 1500

no failover

no asdm history enable

arp timeout 14400

nat-control

access-group inside in interface inside

access-group inside out interface inside

route inside 0.0.0.0 0.0.0.0 10.4.4.3 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 1:00:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh timeout 5

console timeout 0

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect skinny

inspect smtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:7c5bd4abd770cb0bb0014b584ec0c913

</font>

Thanks.

1 Accepted Solution

Accepted Solutions

plumbis
Level 7
Level 7

Looks like you need the "icmp permit any inside". You also need to make sure you are passing the vlans to the FWSM from the switch. You can do this with the command "firewall vlan-group 1 vlan 400" and "firewall module group 1".

View solution in original post

3 Replies 3

plumbis
Level 7
Level 7

Looks like you need the "icmp permit any inside". You also need to make sure you are passing the vlans to the FWSM from the switch. You can do this with the command "firewall vlan-group 1 vlan 400" and "firewall module group 1".

Hi Pete,

Thanks for the quick response. I forgot to include the following lines in my initial post:

firewall module 9 vlan-group 1,

firewall vlan-group 1 400

Leo Laohoo
Hall of Fame
Hall of Fame

Thanks Pete. Problem rectified. +5 from me.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card