topic Re: pix 6.3.5 ping interface in Network Security

pix 6.3.5 ping interface

dragec — Mon, 11 Mar 2019 10:51:33 GMT

I cannot ping external interface of pix from inside. Access list permits this traffic. I cannot find anything in logs. What is missing?

Re: pix 6.3.5 ping interface

Jon Marshall — Tue, 31 Jul 2007 06:03:52 GMT

You are not missing anything. The pix will not allow you to ping a "remote" interface ie. you can ping the inside interface from the inside, you can ping the outside interface from the outside. But you can't ping the inside interface from outside and the outside from inside.

Note with pix v7.x you can allow this by using the command

managment-access inside

HTH

Jon

Re: pix 6.3.5 ping interface

purohit_810 — Tue, 31 Jul 2007 19:31:34 GMT

Hi,

If you would open PING (ICMP) follow the process:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo

access-group 101 in interface outside

PING from Outbound:

static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0

!--- and either

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable

conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded

!--- or

access-list 101 permit icmp any host 192.168.1.5 echo-reply

access-list 101 permit icmp any host 192.168.1.5 source-quench

access-list 101 permit icmp any host 192.168.1.5 unreachable

access-list 101 permit icmp any host 192.168.1.5 time-exceeded

access-group 101 in interface outside

More troubleshoting steps you can find from URL:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Dharmesh Purohit

Re: pix 6.3.5 ping interface

dragec — Wed, 01 Aug 2007 03:56:09 GMT

I do not have problem with pinging hosts. I have problem with pinging fw interfaces.

Re: pix 6.3.5 ping interface

aalmuhajab — Thu, 02 Aug 2007 20:32:39 GMT

Hi there,

If you were in the inside segment you can't ping the pix outside interface or DMZ. That's a pix thing. You can however, ping the interfaces (inside, outside, dmz, etc..) from the respective segment. For example, machines on the outside should be able to ping the PIX outside interface but will not be able to ping the PIX inside interface (assuming you have not blocked icmp on the pix interface). Machines in the inside can't ping pix outside interface but can ping inside interface. Think of it as you only can ping adjacent PIX interface only and not other ping interfaces. But you should be able to ping all other hosts in different zones assuming the proper security policy is applied.

Hope this helps.

Amin