Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Converting from cli to pdm

To ping outside and dmz devices, I used to configure "conduit permit icmp any any". With pdm, I have my implicit permit rules from high to low security interfaces. In order to allow icmp echo replies back through, I configure a rule to allow icmp echo-replies from outside to inside - ok.

But if I configure a rule to allow a dmz to pass icmp echo-replies back to the inside, it replaces the dmz to outside implicit rule and although I can ping out from dmz to outside, I can't pass any other traffic without additional rules.

What is the recommended pdm rule to replace the old conduit, if for example I have one inside, one outside and one dmz interface and I want to able to ping devices on all interfaces from the inside.

New Member

Re: Converting from cli to pdm

Since PDM does not support conduit, you will have to make ACL's for every interfaces. eg

access-list outside_access_in permit icmp any any

access-list dmz_access_in permit icmp any any

Or leave your config as it is with conduit or access-list (not both) for every interface