pix 6.3.5 ping interface

[dragec]

I cannot ping external interface of pix from inside. Access list permits this traffic. I cannot find anything in logs. What is missing?

[Jon Marshall]

Hi

You are not missing anything. The pix will not allow you to ping a "remote" interface ie. you can ping the inside interface from the inside, you can ping the outside interface from the outside. But you can't ping the inside interface from outside and the outside from inside.

Note with pix v7.x you can allow this by using the command

managment-access inside

HTH

Jon

[purohit_810]

Hi,

If you would open PING (ICMP) follow the process:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo

access-group 101 in interface outside

PING from Outbound:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo-reply

access-list 101 permit icmp any host 192.168.1.5 source-quench

access-list 101 permit icmp any host 192.168.1.5 unreachable

access-list 101 permit icmp any host 192.168.1.5 time-exceeded

access-group 101 in interface outside

More troubleshoting steps you can find from URL:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Dharmesh Purohit

[dragec]

I do not have problem with pinging hosts. I have problem with pinging fw interfaces.

[aalmuhajab]

Hi there,

If you were in the inside segment you can't ping the pix outside interface or DMZ. That's a pix thing. You can however, ping the interfaces (inside, outside, dmz, etc..) from the respective segment. For example, machines on the outside should be able to ping the PIX outside interface but will not be able to ping the PIX inside interface (assuming you have not blocked icmp on the pix interface). Machines in the inside can't ping pix outside interface but can ping inside interface. Think of it as you only can ping adjacent PIX interface only and not other ping interfaces. But you should be able to ping all other hosts in different zones assuming the proper security policy is applied.

Hope this helps.

Amin