We are attempting to build a new distribution block for our WAN backbone. We are having a problem in establishing ICMP and Telnet through the PIX. The following is known:
1. Ping and telnet from the 6509 and internal network works fine to the PIX.
2. Ping from the 7206 to the PIX works fine.
3. Debug ICMP trace show normal activity for ICMP connections to the PIX from the 6509 and internal network; however, the debug shows nothing - no activity - during attempts to ping to a.b.5.18. (shown below).
In short, all the connections seem to be fine between the three devices, however, we can't get ICMP and Telnet to work correctly through the PIX.
The layout is:
6509(MSFC) ------- PIX 525 ----------7206
IP:a.b.5.1 ---a.b.5.2 a.b.5.17 --- a.b.5.18
255.255.255.0 255.255.255.240 255.255.255.240
(both)
networks: a.b.5.0 a.b.5.16
255.255.255.240 255.255.255.240
6509:
interface VlanX
description newwan-bb
ip address a.b.5.1 255.255.255.0
no ip redirects
router ospf <pid>
log-adjacency-changes
redistribute static metric 50 metric-type 1 subnets
passive-interface default
no passive-interface Vlan9
((other networks omitted))
network a.b.5.0 0.0.0.255 area 0
default-information originate
PIX 525:
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 failover security10
hostname XXXXXX
domain-name XXX.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 102 permit ip any any
access-list 102 permit icmp any any
access-list 102 permit icmp any any echo
access-list 102 permit icmp any any echo-reply
access-list 102 permit icmp any any source-quench
access-list 102 permit icmp any any unreachable
access-list 102 permit icmp any any time-exceeded
access-list 103 permit ip any any
access-list 103 permit icmp any any
access-list 103 permit icmp any any echo
access-list 103 permit icmp any any echo-reply
access-list 103 permit icmp any any source-quench
access-list 103 permit icmp any any unreachable
access-list 103 permit icmp any any time-exceeded
pager lines 24
logging on
logging timestamp
logging buffered notifications
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
mtu outside 1500
mtu inside 1500
mtu failover 1500
ip address outside a.b.5.17 255.255.255.240
ip address inside a.b.5.2 255.255.255.240
ip address failover 192.168.230.1 255.255.255.252
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group 103 in interface outside
route outside 0.0.0.0 0.0.0.0 a.b.5.18 1
route inside a.0.0.0 255.0.0.0 a.b.5.1 1
route inside a.b.0.0 255.240.0.0 a.b.5.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet a.0.0.0 255.0.0.0 outside
telnet a.0.0.0 255.0.0.0 inside
telnet a.b.0.0 255.240.0.0 inside
telnet a.b.5.18 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
terminal width 80
Appreciate any help in proper routing through a PIX 525, given that all this is for an internal network.
