The problem is I can ping all the lower interface ip being in 172.16.1.0 network i.e pix inside network, but I can not ping the same lower interfaces from the 172.18.1.0 network which is behind ISA Firewall.Please note that the ISA act as brige all the ports are opened both in & out.
I used NAT (inside 0 0 0 0 0
also NAT (inside) 0 access-list no-nat with
access-list no-nat permit ip 172.18.10 255.255.255.0 any ---> NAT EXEMPTION
The 172.18.1.0 network is behind ISA server. I can explain that the ISA server is between the PIX firewall and the 172.18.1.0 network. ISA inside NIC connected to the 172.18.1.0 network and the ISA server outsdie NIC connected to the PIX Inside network that is 172.16.1.0. other PIX's interfaces are DMZ1, DMZ2, DMZ3.We can ping all the dmzs from 172.16.1.0 not from 172.18.1.0.
In the pix firewall all high to lower interfaces are configured with identity NAT (NAT 0 )
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...