Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

pix 6.3.5 ping interface

I cannot ping external interface of pix from inside. Access list permits this traffic. I cannot find anything in logs. What is missing?

4 REPLIES
Hall of Fame Super Blue

Re: pix 6.3.5 ping interface

Hi

You are not missing anything. The pix will not allow you to ping a "remote" interface ie. you can ping the inside interface from the inside, you can ping the outside interface from the outside. But you can't ping the inside interface from outside and the outside from inside.

Note with pix v7.x you can allow this by using the command

managment-access inside

HTH

Jon

Silver

Re: pix 6.3.5 ping interface

Hi,

If you would open PING (ICMP) follow the process:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo

access-group 101 in interface outside

PING from Outbound:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo-reply

access-list 101 permit icmp any host 192.168.1.5 source-quench

access-list 101 permit icmp any host 192.168.1.5 unreachable

access-list 101 permit icmp any host 192.168.1.5 time-exceeded

access-group 101 in interface outside

More troubleshoting steps you can find from URL:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Dharmesh Purohit

Community Member

Re: pix 6.3.5 ping interface

I do not have problem with pinging hosts. I have problem with pinging fw interfaces.

Community Member

Re: pix 6.3.5 ping interface

Hi there,

If you were in the inside segment you can't ping the pix outside interface or DMZ. That's a pix thing. You can however, ping the interfaces (inside, outside, dmz, etc..) from the respective segment. For example, machines on the outside should be able to ping the PIX outside interface but will not be able to ping the PIX inside interface (assuming you have not blocked icmp on the pix interface). Machines in the inside can't ping pix outside interface but can ping inside interface. Think of it as you only can ping adjacent PIX interface only and not other ping interfaces. But you should be able to ping all other hosts in different zones assuming the proper security policy is applied.

Hope this helps.

Amin

702
Views
5
Helpful
4
Replies
CreatePlease to create content