Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

PIX Multiple Inside Config

This should be straight forward, but for some reason I'm missing something. I have a PIX with 6 interface

E0 Outside

E1 Inside


E3 Guest

The Guest interface is the guest VLAN for the company and I want to allow access to the Internet while blocking all of our internal stuff. Sample config is here:

int e0

nameif outside

ip add

security-level 0

int e1

nameif inside

ip add

security-level 100

int e2

nameif dmz

ip add

security level 50

int e3

nameif Guest

ip add

security level 90

nat (inside) 1 0 0

nat (Guest) 2 0 0

global (outside) 1

global (outside) 2

access-list Guest_out permit ip any any

access-gr Guest_out in interface guest

Based on the config above, that should be enough to have the Guest vlan traffic PAT to and have no issue going out?

Am I missing something?


Re: PIX Multiple Inside Config

Typo maybe, capital "G" in guest.

access-group Guest_out in interface Guest


Re: PIX Multiple Inside Config

Typo maybe, capital "G" in guest. Although that would not have prevented you from getting outside.

access-group Guest_out in interface Guest

Cisco Employee

Re: PIX Multiple Inside Config

There isn't any issue with Typo...the config is absolutely good and would allow all IP traffic from Guest to go outside patting to

are you facing any issue ?


Re: PIX Multiple Inside Config

Actually there is a typo. And as I said, it would not have effected his ability to go outside.

Community Member

Re: PIX Multiple Inside Config

Yes I am, return traffic is not being permitted back in. I can see the xlate going through ie:

Built ICMP connection for faddr x.x.x.x/0 gaddr laddr 192.168.1.x

That outside IP i'm pinging is a router which is running debug ip icmp. I can see the source address of the ping as the global PAT'd address on the Firewall. So the config looks good, return traffic is not getting back through. The ACL on the outside interface shouldn't be blocking the traffic as it was sourced from inside..


Re: PIX Multiple Inside Config

That is not the case with icmp. You must allow it in your outside acl on the firewall.

This also serves as proof there was a typo, as he would have had to allow icmp as well in his Guest acl.

Cisco Employee

Re: PIX Multiple Inside Config

add a line permit icmp any any echo-reply on the outside access-list, if not then create one access-g on outside permitting icmp echo-reply

you are correct firewall doesn't block traffic initiated from inside, however this is ICMP, firewall treats it stateless protocol and consider the return echo reply as different connection

They fixed this issue in code 7.0 and above with "Inspect Icmp" feature

CreatePlease to create content