Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

help check PIX535's config

I have a PIX535 which upconnect to a router and downconnect to three lans.

I don't want to config nat on the three lans for the reason that the three lans all use legal ip

I want to do the following things

1 Hosts on Inside0¡¢Inside1¡¢Inside2 can reach internet£¨for example can ping£©

2 I can telnet the inside0¡®s lanswitch(ip:B1.B2.B3.B5)¡¢

the inside1¡®s lanswitch(ip:C1.C2.C3.C5)¡¢

the inside2¡®s lanswitch(ip:D1.D2.D3.D5)

from Outside0 router

After I did the following config £¬

I can ping from insdie0/1/2's lanswitch to outside

but I can only ping and telnet inside0¡®s lanswitch(ip:B1.B2.B3.B5) from Outside router

and can not ping and telnet inside0¡®s lanswitch(ip:B1.B2.B3.B5)¡¢inside2¡®s lanswitch(ip:D1.D2.D3.D5) from Outside router

I want to know the insdie0/1/2'security value are equal why can only ping the inside0

Please help to check the main config,thxs very much.

main config

nameif gb-ethernet0 Outside0 security0

nameif gb-ethernet2 Inside0 security90

nameif ethernet0 Inside1 security90

nameif ethernet1 Inside2 security90

access-list acl_Outside0 permit icmp any any

access-list acl_Outside0 permit tcp A1.A2.A3.0 host B1.B2.B3.B5 eq telnet

access-list acl_Outside0 permit tcp A1.A2.A3.0 host C1.C2.C3.C5 eq telnet

access-list acl_Outside0 permit tcp A1.A2.A3.0 host D1.D2.D3.D5 eq telnet

ip address Outside0 A1.A2.A3.A4

ip address Inside0 B1.B2.B3.B4

ip address Inside1 C1.C2.C3.C4

ip address Inside2 D1.D2.D3.D4

nat (Inside0) 0 0 0

nat (Inside1) 0 0 0

nat (Inside2) 0 0 0

access-group acl_Outside0 in interface Outside0

route Outside0 A1.A2.A3.A5 1

Cisco Employee

Re: help check PIX535's config

The config looks OK, although keep in mind that setting the same security level on different interfaces means you will have NO connectivity between those interfaces at all. Some people think that the opposite would be true in that you would have all access, but this is not the case.

Anyway, in regard to your problem, the config looks OK, and it's strange that you can ping FROM these inside hosts but can't ping to them. Are you sure you don't have access-lists or something on those hosts themselves? The best way to see if the PIX is stopping anything is to check the log messages. Do "logging console debug" then attach a console and then try the pinging and see what happens.

New Member

Re: help check PIX535's config

I have got it when I the following command

static (Inside0,Outside0) B1.B2.B3.B5 B1.B2.B3.B5 (Inside0's Lanswitch IP)

static (Inside1,Outside0) C1.C2.C3.C5 C1.C2.C3.C5(Inside1's Lanswitch IP)

static (Inside2,Outside0) D1.D2.D3.D5 D1.D2.D3.D5(Inside2's Lanswitch IP)

But I want to know ,before I config the static command

firstly why the NAT 0 0 0 don't become effective

secondly why I can ping the hosts connecting to the lanswitch and can not ping lanswitch .You know they are all in a same subnet.

My PIX 535's version is 6.1(2) there are some bugs in it or advise me which version is better in PIX535

My lanswitch is a 2948G which version is 6.3(5) ,one in a thousand there are some bugs in it

Cisco Employee

Re: help check PIX535's config

Nat 0 doesn't just simply allow all packets in and out like you think it would. For traffic to pass from outside to inside with a nat 0 statement, traffic has to have travelled from inside to outside first.

For example, let's say you want to ping a host on the inside from a host on the outside, and your PIX just has nat 0 and an ACL allowing pings in. If you sit on the outside host and try a ping it will not get through. You first have to ping from the inside host to the outside host, which creates the translation in the PIX. Once you've done that you'll now be able to ping from the outside host to the inside.

Is it possible that you've pinged FROM all the inside hosts to the outside host, but not from the LANswitch itself? As I said, traffic has to travel outbound BEFORE traffic will be able to travel inbound when you use nat 0.

When you added the specific static statements for the LANswitch that over-rode the nat 0 statement and you could then ping both ways.

New Member

Re: help check PIX535's config

I see.Thanks very much

CreatePlease login to create content