Cisco Support Community
Community Member

No connectivity from Inside to Outside Segments

Dear All,

I have the following test lab environment with a PIX 506E.











Internal Network Hosts

I have two laptops in each segment with and IP addresses. However, I'm unable to ping each other even though i have modified the ACL to permit IP any any (only for testing purposes!!)

The outside laptop can ping its default gateway (router) and the outside PIX interface.

The inside laptop can ping its default gateway (the PIX inside interface) without any problems. However, these two laptops cannt ping each other. I dont want to use any NATting as I'd be using real IP addresses in the production. But I can't get the test lab network working.

Also I'm not sure whether the Static Statement i have added is essential. No success even without that.

Thanks in advance.

PIX Version 6.3(4)

interface ethernet0 100basetx

interface ethernet1 100basetx

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname pixfirewall

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69


access-list acl_out permit ip any any

access-list all-ip-packet permit ip any any

pager lines 24

logging buffered debugging

mtu outside 1500

mtu inside 1500

ip address outside

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

static (inside,outside) netmask 0 0

access-group all-ip-packet in interface outside

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80


: end



Re: No connectivity from Inside to Outside Segments

with pix v6.x, nat/global or static is a must do before pix would start forwarding packet between the interfaces. thus, the posted static statement is required.

regarding the pinging, i was wondering if the laptop has the default gateway set to router, and whether or not the router has a route for subnet

further, issue the command "debug icmp trace" on the pix. the output should provide more info, including the icmp traffic flow such as echo request and reply.

Re: No connectivity from Inside to Outside Segments


Try to use/add nat 0 instead of static nat (inside,outside)

-> nat (inside) 0



CreatePlease to create content