Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Stupid ICMP question... PLEASE HELP!!

Hi,

I need some help regarding ICMP destined to a DMZ host/subnet from the a nonconnected inside subnet. I have 2 PIX 525's at 2 different locations. The subnets know about each other via routing on a pair 6513's at each site. I CAN ping from PIX inside to PIX inside over the WAN link, but i canNOT ping from one PIX to a host on the DMZ off of the other PIX. All hosts on the inside CAN ping the DMZ host (web server) except the PIX on the far network.

What do you need to know about the config in order to give an answer?

Thanks in advance...

Josh

8 REPLIES

Re: Stupid ICMP question... PLEASE HELP!!

Hi,

did you configure the necessary access-lists to allow icmp-reply and icmp-request packets?

Regards,

Tom

New Member

Re: Stupid ICMP question... PLEASE HELP!!

Well, yes. But now I'm second guessing my kung-fu...

acccess-list DMZ_whatever permit icmp any any

Silver

Re: Stupid ICMP question... PLEASE HELP!!

Which interface on the Pix leads to the WAN interface?

When you CAN ping, do you mean you're pinging from one pix to the other? Or from a inside host on one pix to a host on the other pix?

With the failing ping to the DMZ, is this ping from the Pix to the host on the other Pix? Or some inside host? If an inside host, is it the same one that can successfully ping inside hosts on the other pix?

New Member

Re: Stupid ICMP question... PLEASE HELP!!

The WAN link is on the inside of both PIX and routed via 6513's on both sides.

(When you CAN ping, do you mean you're pinging from one pix to the other?)

-Yes

(Is this ping from the Pix to the host on the other Pix?)

-Yes, but not successful. This is what needs to be fixed (just to clarify).

As I stated, I can ping from PIX to PIX inside interfaces, and i can ping from any host on any of the inside subnets to the DMZ host and NOT from "far side" PIX to DMZ host on "near side" PIX.

New Member

Re: Stupid ICMP question... PLEASE HELP!!

Anyone care to come back to this? I could use the help... Thanks...

Gold

Re: Stupid ICMP question... PLEASE HELP!!

Hi Joshua,

Ok, not seeing your PIX config, don't help but here's a suggestion (if it's any help to you).

Have you got any of the following ACL's applied on your two PIX's :

access-list ping_acl permit icmp any any

access-group ping_acl in interface dmz

access-group ping_acl in interface outside

Also, here's a good troubleshooting link (that I think might be helpful to you) :

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/config/bafwcfg.htm#xtocid25

Hope this helps and let us know how you got on.

Thanks --

New Member

Re: Stupid ICMP question... PLEASE HELP!!

Here is what I have for ICMP access lists and accociated groups:

access-list outside-access-in permit icmp any any echo-reply

access-list outside-access-in permit icmp any any time-exceeded

access-list outside-access-in permit icmp any any unreachable

access-list DMZ-access-in permit icmp any any

access-group outside-access-in in interface outside

access-group DMZ-access-in in interface DMZ-1

However, the outside has nothing to do with the issue as I am not accessing anything via the outside interface... I just wanted to include it for the sake of showing ALL ICMO access allowed through the PIX's.

This I have on both PIX so they can ping each others INTERNAL interfaces (this works):

route inside (Int subnet) 255.255.0.0 (Int router) 1

Maybe tis isn't a "stupid ICMP question" after all... hehe...

Thanks,

Josh

New Member

Re: Stupid ICMP question... PLEASE HELP!!

Nevermind all... i figured it out!

I needed a non translated static statement for the subnet I was trying to ping from (the subnet the inside interface of the "far side" firewall sits on).

Here is the missing element for reference:

static (inside,DMZ-1) far_side_sn far_side_sn netmask 255.255.255.0 0 0

Thanks anyway all,

Josh

191
Views
0
Helpful
8
Replies
CreatePlease login to create content