It looks like it is only reachable e.g. for ICMP once it pinged the other end first.
I try from ping 10.0.0.1 (host) and 10.0.0.254 (gateway) to the outside interface with no success.After pinging from the outside interface to this IPs I get two-way communication going. But just to the PIX not the host mapped by the static command.
This behaviour is reproducible by clearing the arp entries on the host and the gateway.
I did some research mirroring traffic to and from the PIX and it does not seems to recognize the ARP requests at all.
debug arp gives me nothing at all.
BTW the gateway is a Alpine 3808 and the host is switched through it to access the PIX which is on a dedicated port there.
Important part of the config follows:
interface ethernet0 100full
interface ethernet1 100full
interface ethernet1 vlan2 logical
interface ethernet1 vlan3 logical
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan2 dmz security10
nameif vlan3 internal security90
access-list ACL_OUTSIDE_IN permit icmp any any
access-list ACL_OUTSIDE_IN permit ip host 10.0.0.1 any
access-list ACL_OUTSIDE_IN permit ip host 10.0.0.2 any
access-list ACL_DMZ_IN deny ip 192.168.254.0 255.255.255.0 192.168.254.0
access-list ACL_DMZ_IN permit icmp any any
access-list ACL_DMZ_IN permit ip any host 10.0.0.1
access-list ACL_DMZ_IN permit ip any host 10.0.0.2
access-list ACL_DMZ_IN permit udp any host 10.1.1.4 eq domain
access-list ACL_DMZ_IN permit udp any host 10.1.1.5 eq domain
If i was you, I would drop the DMZ ACL's and just have ACLS that relate to the static statements, then use nat for the inside clients to access the public and dmz networks. Also use nat for the dmz to access the public network.
also, are you trying to block trying going OUT of the dmz or IN to it? You did an IN statement, not and usually you block at the outside interface, not the dmz one.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...