Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Adding inbound connection


We are using a PIX (2 interface). Im trying to add an inbound connection to our server inside the network.

The inside address is and the outside address is First thing I did was to try to ping the outside address ( in the firewall itself, I used the config below. Is this correct? I can't seamed to ping the, do you think this is normal? I tried to ping from our router outside, it does not reply either, can anyone help? Thanks in advance.

: Saved


PIX Version 5.3(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname PIX

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060


access-list acl_out permit icmp any host

pager lines 24

logging on

no logging timestamp

no logging standby

no logging console

no logging monitor

no logging buffered

no logging trap

no logging history

logging facility 20

logging queue 512

interface ethernet0 auto

interface ethernet1 auto

mtu outside 1500

mtu inside 1500

ip address outside

ip address inside

ip audit info action alarm

ip audit attack action alarm

arp timeout 14400

global (outside) 1 netmask

nat (inside) 1 100 50

alias (inside)

static (inside,outside) netmask 0


static (inside,outside) netmask 0 0

access-group acl_out in interface outside

conduit permit icmp any any

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

no sysopt route dnat

isakmp identity hostname

telnet inside

telnet inside

telnet timeout 60

ssh timeout 5

terminal width 80

PIX(config)# show xlate

Global Local static

Global Local static

Global Local

  • Other Security Subjects
New Member

Re: Adding inbound connection

I noticed that the outside IP address has a different IP network address outside which is For sure it won't ping because it has different network address. It seems that 230 is not Class C address because class C is from 192 to 223 only.

New Member

Re: Adding inbound connection


Thanks for the respond, anyways, I entered the wrong address at the top, it should be 230.13.200.*. This sub net is just a sample, I replaced my real external subnet id to this one, just incase theres hackers snooping around this forum.

What Im trying to do here is map the external address to the internal one Note that is my PIX515. You mean I have to map to the pix address (



New Member

Re: Adding inbound connection

you do not need to map the inside host to the outside interface. Have you try to ping the outside interface from a client? your conifg looks fine

New Member

Re: Adding inbound connection


If you haven't resolved this as yet. I don't see a route statement for the inside for the pix to get to your inside subnets.

Hope this helps.

New Member

Re: Adding inbound connection

Your access-list is the problem. What you are doing is premiting Icmp from any host on the outside to host

I beileve you have to specify if you want the host to send echo or just to reply.


try this access-list acl_out permit icmp any host echo

access-list acl_out permit icmp any host echo-reply


access-list acl_out permit icmp host any echo

access-list acl_out permit icmp host any echo-reply.

This widget could not be displayed.