Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Return Ping Packets blocked by Pix Firewall

Hi Guys,

I have a rule from inside interface (security 100) to ping a server on a DMZ interface (secuirty 40). But I dont have the same rule other way around (from dmz to inside). When I do a ping the return ping packet from DMZ interface is dropped by the firewall.

Any idea why? Do I really need a rule for return ping traffic as well.

Tks

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Return Ping Packets blocked by Pix Firewall

Hello,

What code version you are running? With ICMP packet in each direction is

treated as a separate flow. If you have not enabled ICMP inspection (or icmp

fixup) then the firewall will drop the return icmp traffic. In that case,

you need to exclusively allow return ICMP traffic through access-lists.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note0918

6a0080094e8a.shtml

Hope this helps.

Regards,

NT

1 REPLY
Cisco Employee

Re: Return Ping Packets blocked by Pix Firewall

Hello,

What code version you are running? With ICMP packet in each direction is

treated as a separate flow. If you have not enabled ICMP inspection (or icmp

fixup) then the firewall will drop the return icmp traffic. In that case,

you need to exclusively allow return ICMP traffic through access-lists.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note0918

6a0080094e8a.shtml

Hope this helps.

Regards,

NT

235
Views
0
Helpful
1
Replies