Hi Namit,

I would like to allow icmp resquest (and replies) in both ways.

Thanks in advance for your help.

Hi Samantha,

The default behavior of the firewall is that the Inbound ICMP through the PIX is denied by default; outbound ICMP is permitted, but the incoming reply is denied by default.So to be able to allow the ping from the network behind the outside interface we need a matching NAT statement and an ACL (which is already in place using conduit ). Please take a look at the following link, hope it helps http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic3

Cheers,

Namit

Hi again,

Refering to your link I saw I missed the static line entry... As I don't perform NAT I added this to my config:

static (inside,outside) 200.0.10.5 200.0.10.5 netmask 255.255.255.255 0 0

Unfortunatly it still doesn't work... Any other clue ?
Thanks.

Hi Samantha,

Please run the following command on the PIX "debug icmp trace" when you initiate pings and paste the output.

Thanks,

Namit

So I ran the "debug icmp trace" command and here is what happenned.

When I tried to ping from the inside (from 200.0.10.5) to the firewall interfaces (200.0.10.1 and 200.0.11.1) or the router (200.0.11.2), nothing appeared on the firewall console.

After that I tried to ping from the firewall and this appeared on the console :

pixfirewall(config)# debug icmp trace
ICMP trace on
Warning: this may cause problems on busy networks
pixfirewall(config)# ping 200.0.10.5
1: ICMP echo request (len 32 id 9233 seq 0) 200.0.10.1 > 200.0.10.5
        200.0.10.5 NO response received -- 1000ms
2: ICMP echo request (len 32 id 9233 seq 1) 200.0.10.1 > 200.0.10.5
        200.0.10.5 NO response received -- 1000ms
3: ICMP echo request (len 32 id 9233 seq 2) 200.0.10.1 > 200.0.10.5
        200.0.10.5 NO response received -- 1000ms
pixfirewall(config)# ping 200.0.12.1
4: ICMP echo request (len 32 id 9233 seq 0) 200.0.11.1 > 200.0.12.1
        200.0.12.1 NO response received -- 1000ms
5: ICMP echo request (len 32 id 9233 seq 1) 200.0.11.1 > 200.0.12.1
        200.0.12.1 NO response received -- 1000ms
6: ICMP echo request (len 32 id 9233 seq 2) 200.0.11.1 > 200.0.12.1
        200.0.12.1 NO response received -- 1000ms
pixfirewall(config)# ping 200.0.11.2
7: ICMP echo request (len 32 id 9233 seq 0) 200.0.11.1 > 200.0.11.2
        200.0.11.2 NO response received -- 1000ms
8: ICMP echo request (len 32 id 9233 seq 1) 200.0.11.1 > 200.0.11.2
        200.0.11.2 NO response received -- 1000ms
9: ICMP echo request (len 32 id 9233 seq 2) 200.0.11.1 > 200.0.11.2
        200.0.11.2 NO response received -- 1000ms

I have to add that I cleared the arp table of the firewall and whenever I tried to ping from the inside, the arp table is updated with new entries (even though I don't receive icmp replies).

Hi Samantha,

Please add the following commands and try

icmp permit 0 0 outside

icmp permit 0 0 inside

Cheers,

Namit

I add those two entries to the config and tried to ping again but it still does'nt work. I got the same as before

Hey Samantha,

Please add the command "fixup protocol icmp" on the PIX if you have not done so already and test the pings then. If it still does not help, please apply captures on the inside and outside interfaces and paste the captures here. For help with captures, please refer the below:

https://supportforums.cisco.com/docs/DOC-1222

Also, please post the output of "show nat", "show global" and "show static" from the PIX.

Thanks and Regards,

Prapanch

Hey Prapanch,

Here are the outputs of "show nat", "show global" and "show static" from the PIX:

pixfirewall# show nat
nat (inside) 0 access-list nonat
nat (inside) 0 200.0.11.0 255.255.255.0 0 0
pixfirewall# show global
pixfirewall# show static
static (inside,outside) 200.0.10.5 200.0.10.5 netmask 255.255.255.255 0 0
static (inside,outside) 200.0.11.2 200.0.11.2 netmask 255.255.255.255 0 0
static (inside,outside) 200.0.12.1 200.0.12.1 netmask 255.255.255.255 0 0

And here are the captures:

pixfirewall(config)# access-list cap-list permit ip any any
pixfirewall(config)# capture in-cap interface inside access-list cap-list buff$
pixfirewall(config)# capture out-cap interface outside access-list cap-list bu$
pixfirewall(config)# ping 200.0.11.2
31: ICMP echo request (len 32 id 9233 seq 0) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
32: ICMP echo request (len 32 id 9233 seq 1) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
33: ICMP echo request (len 32 id 9233 seq 2) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
pixfirewall(config)# ping 200.0.12.1
34: ICMP echo request (len 32 id 9233 seq 0) 200.0.11.1 > 200.0.12.1
         200.0.12.1 NO response received -- 1000ms
35: ICMP echo request (len 32 id 9233 seq 1) 200.0.11.1 > 200.0.12.1
         200.0.12.1 NO response received -- 1000ms
36: ICMP echo request (len 32 id 9233 seq 2) 200.0.11.1 > 200.0.12.1
         200.0.12.1 NO response received -- 1000ms
pixfirewall(config)# ping 200.0.10.5
37: ICMP echo request (len 32 id 9233 seq 0) 200.0.10.1 > 200.0.10.5
         200.0.10.5 NO response received -- 1000ms
38: ICMP echo request (len 32 id 9233 seq 1) 200.0.10.1 > 200.0.10.5
         200.0.10.5 NO response received -- 1000ms
39: ICMP echo request (len 32 id 9233 seq 2) 200.0.10.1 > 200.0.10.5
         200.0.10.5 NO response received -- 1000ms
pixfirewall(config)# ping 200.0.11.2
40: ICMP echo request (len 32 id 9233 seq 0) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
41: ICMP echo request (len 32 id 9233 seq 1) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
42: ICMP echo request (len 32 id 9233 seq 2) 200.0.11.1 > 200.0.11.2
         200.0.11.2 NO response received -- 1000ms
pixfirewall(config)# sh capture out-cap
5 packets captured
13:59:25.192433 200.0.11.2.51029 > 255.255.255.255.69:  udp 22
13:59:28.190007 200.0.11.2.51029 > 255.255.255.255.69:  udp 22
13:59:32.189885 200.0.11.2.51029 > 255.255.255.255.69:  udp 22
13:59:37.189733 200.0.11.2.51029 > 255.255.255.255.69:  udp 22
13:59:43.189611 200.0.11.2.51029 > 255.255.255.255.69:  udp 22
5 packets shown
pixfirewall(config)# sh capture in-cap
3 packets captured
13:57:25.302886 200.0.10.1 > 200.0.10.5: icmp: echo request
13:57:26.295028 200.0.10.1 > 200.0.10.5: icmp: echo request
13:57:27.295043 200.0.10.1 > 200.0.10.5: icmp: echo request
3 packets shown

I'm sorry I have to leave now but I will come again tomorrow,

Thanks everyone for trying hard to help,

Samantha.

Hi again Prapanch !

Were you able to figure something out with the captures and outputs I sent you?

Thanks again,

Samantha.

Hi Samantha,

It certainly looks like the PIX is dropping the ICMP packets. Have you added the "fixup protocol icmp" command? Also, can you paste a sanitized configuration here from the PIX once again? Seems like a lot of changes have been made since you started out.

Thanks and Regards,

Prapanch

Hello everyone,

So with some help we finally figured the problem out. Our firewall was a “standby” unit (back up firewall), so we had to define failover IP addresses.

failover ip address outside 200.0.11.3

failover ip address inside 200.0.10.2

After that we could ping the firewall from host 200.0.10.5 and vice-versa.

Thanks everyone for your time and help,

Samantha.