topic Re: PIX outside interface in Network Security

PIX outside interface

alvarez_rafa — Mon, 11 Mar 2019 09:10:03 GMT

Hello. I am trying to get the outside interface (E0) on a 515 pix to communicate to a router. I got the following ip addresses:

Router: 216.x.x.129

Pix: 216.x.x.131

Netmask of 25 bits.

I got a laptop connected to this network (via a switch), i put it's default gateway to be the router interface and set up its DNS. The laptop is able to connect to the internet. Now, i disconnected the laptop and put the same ip i used on the pix interface, in the same ip network and everything, but i can't ping the router's ip address.

What am i doing wrong or what am i missing?

Re: PIX outside interface

nicholash101 — Sun, 17 Dec 2006 15:59:08 GMT

Is the link speed and duplex configured correctly between the pix and router?

Does a sh int eth0 show the link as being down on the pix?

Until you assign link speed, duplex, and an IP Address (even if it's just auto/auto) to the interfaces on the pix they will remain in an administratively down state.

I've also run into a situation where a freshly configured pix 501 (OS 6.3(4)) was working perfectly before deployment but failed to work at deployment time even though no configuration changes were made in the interim. I couldn't ping the DG from the pix.

I ended up erasing the configuration, clearing the ssh keys, and reconfiguring it before it would work in the new location.

Re: PIX outside interface

alvarez_rafa — Sun, 17 Dec 2006 17:54:35 GMT

Hi man, thanks for the reply. I found the problem!!! This pix was on a failover group, and by some strange reason, when disconnecting the failover link, it didn't become master. So i just went ahead and disabled failover and the pix started pinging fine.

Thanks for the help man. In fact, that's gonna help me out later when setting up the other interfaces on the pix.

Re: PIX outside interface

sayeedk — Mon, 18 Dec 2006 19:47:47 GMT

Probably your laptop as arp entry cached, clear the ARP on the laptop.

HTH

Re: PIX outside interface

petpeterpeace — Wed, 17 Jan 2007 10:11:21 GMT

alvarez_rafa,

Im new to pix firewall, I have a new pix515E. plz help me how to configure the pix so that I can ping from inside to outside interface and vice versa. also I can configure to telnet from my PC to pix via inside interface, but cannot to outside interface. plz help me.

your help would be greatly appriciated.

Peter,

petpeterpeace@hotmail.com

Re: PIX outside interface

sayeedk — Wed, 17 Jan 2007 16:02:42 GMT

If you are pinging from Pix it should work, try tying the ip address agian, shut and no shut the interface , clear arp cache on router and pix, this might do some magic, otherwise it difficult to understand why it not wiorking.

if you pinging behind the pix from a laptop, then there could me several issues.

Even tough High to Low works with access-list but ICMP is exception, so make sure you are allowing ICMP to come back. Also check you Global and Nat or Static.

HTH

Re: PIX outside interface

petpeterpeace — Tue, 23 Jan 2007 01:26:08 GMT

thank you for your help,

yes, I can ping to inside interface (if i connect cross cable directly to this interface, or i can also ping to the outside interface (if i connect cross cable from my pc directly to this interface), but cannot ping to inside interface (if my PC is connecting from ouside interface and vice versa)

This is the basic configuration:

nameif ethernet0 outside security0

nameif ethernet1 inside security100

interface ethernet0 100basetx

interface ethernet1 100basetx

ip address outside 209.165.201.3 255.255.255.224

ip address inside 209.165.202.129 255.255.255.0

hostname pixfirewall

arp timeout 14400

no failover

names

pager lines 24

logging buffered debugging

access-list acl_out permit icmp any any

access-group acl_out in interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00

udp 0:02:00 rpc 0:10:00 h323 0:05:00

sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

no snmp-server location

no snmp-server contact

snmp-server community public

mtu outside 1500

mtu inside 1500

plz give me your ideas

thanks so much

Peter