Cisco Support Community
Community Member

Novell server can't get past PIX

I'm swapping firewalls for a customer. Taking out a watchguard soho and going in w/the 501. As of now all clients can get out but the server cannot ping past the internal interface. Here's the config:

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password /F.u.pU7VSgK.2I3 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname pix


fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000


pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 5 interface

nat (inside) 5 0 0

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

no floodguard enable

no sysopt route dnat

telnet timeout 5

ssh timeout 5

terminal width 80

As well as not pinging past the internal int, the

"static (inside, outside)"

command halts all outgoing traffic from all hosts until the firewall is rebooted. It does not do this to any other hosts

I've since tried setting the internal ip(501) to and then setting the default route in tcpcon on the Novell box to the same but w/no results. I'd love to blame the Novell server but the watchgaurd box lets it all through.

Thanks for the time.

Cisco Employee

Re: Novell server can't get past PIX

When you were doing this, did you try to clear the arp table on the outside router? I am assuming that

you were using the same ip address pool and interface address of the previous firewall for the PIX. If not, check the arp entry anyway on the outside router, and see what MAC addr does, correspond to and compare accordingly to the mac addr of the pix outside interface.

Community Member

Re: Novell server can't get past PIX

Looks like you need a conduit or an access-list to allow ICMP.

CreatePlease to create content