topic Cannot ping from the inside network in Network Security

Cannot ping from the inside network

adilmasani — Mon, 11 Mar 2019 10:00:48 GMT

Hi guys,

I have setup a pix 515e with 7.0.(6) I am unable to ping to the internet from the internal hosts. I am able to browse the internet and do DNS lookups. Also the hitcnt does not increment. It always shows up as 0

I have added the following lines to allow icmp through but this does not allow me to ping to the internet. I can ping the external interface of the pix from the internet. Is there something i am not doing right?

access-list in-to-out extended permit icmp object-group internal-lan any log

access-list out-to-in extended permit icmp any any

icmp permit any echo-reply outside

icmp permit any echo outside

icmp permit any outside

icmp permit any inside

Re: Cannot ping from the inside network

zulqurnain — Tue, 17 Apr 2007 04:45:14 GMT

hello,

by default pix does not allow icmp traffic or any other traffic from lower to higher security level, you would have to explicitly allow icmp traffic to pass through the firewall

as per the nature of work for icmp you would have to allow all the below mentioned in order to be able to ping outside ip address.

try this

access-list out_to_in permit icmp any any unreachable

access-list out_to_in permit icmp any any time-exceeded

access-list out_to_in permit icmp any any echo-reply

access-list in_to_out permit icmp any any unreachable

access-list in_to_out permit icmp any any time-exceeded

access-list in_to_out permit icmp any any echo-reply

also make sure you have acl "out_to_in" and "in_to_out" applied to interfaces

access-group out_to_in in interface outside

access-group in_to_out in interface inside

HTH, please rate it

Re: Cannot ping from the inside network

adilmasani — Tue, 17 Apr 2007 22:49:35 GMT

Thanks a lot this fixed it. I had forgotten to apply the access-lists to the interface.