topic Re: Ping PIX in Network Security

Ping PIX

gnaveen — Fri, 21 Feb 2020 08:46:45 GMT

[R4] --- PIX --- [R1]

I need to configure a static route for 10.1.1.x network on R4 and configure PIX so that R4

can ping 10.1.1.1 (R1). But, the configuration does not seem to work.

interface Ethernet0

ip address 20.x.x.x.x.255.0

ip route 10.1.1.1 255.255.255.0 20.1.24.254

PIX

nameif ethernet0 inside security100

nameif ethernet1 outside security0

ip address inside 10.1.1.254 255.255.255.0

ip address outside 20.x.x.x.x.255.0

static (inside,outside) 20.x.x.x.x.1.1 netmask 255.255.255.255 0 0

access-list MYACLOUT permit ip host 20.1.24.4 host 10.1.1.1

access-group MYACLOUT in interface outside

icmp permit host 20.1.24.4 echo outside

icmp deny any outside

icmp deny any inside

interface Ethernet0

ip address 10.1.1.1 255.255.255.0

Ping does not work ?

R4# ping 10.1.1.1

....

Re: Ping PIX

pkhatri — Thu, 16 Mar 2006 03:24:57 GMT

Hi,

Can you try the following config on the PIX:

static (inside,outside) 10.1.1.1 10.1.1.1 netmask 255.255.255.255 0 0

instead of:

static (inside,outside) 20.1.24.4 10.1.1.1 netmask 255.255.255.255 0 0

Hope that helps - pls rate the post if it does.

Paresh

Re: Ping PIX

gnaveen — Thu, 16 Mar 2006 14:28:42 GMT

No, it did not work.

R4#ping 20.1.24.254

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 20.1.24.254, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

R4#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R4#

Re: Ping PIX

gnaveen — Thu, 16 Mar 2006 15:07:44 GMT

No, it did not work.

R4#ping 20.1.24.254

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 20.1.24.254, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

R4#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R4#

Re: Ping PIX

bcarroll — Thu, 16 Mar 2006 16:29:34 GMT

the icmp permit host 20.1.24.4 echo outside is allowing the host 20.1.24.2 to ping the pix, not the server that you have the static for. Add ICMP to your access-list and you should be good to go.

access-list MYACLOUT permit icmp any host 20.1.24.4

Hope this helps.

Re: Ping PIX

oabduo983 — Mon, 03 Apr 2006 13:42:09 GMT

Simple!

Need to have a route back,

Type the following command on R1:

ip route 20.0.0.0 255.0.0.0 10.1.1.254

It should work after that...

All the best.

Re: Ping PIX

laurent.geyer — Thu, 13 Apr 2006 14:59:36 GMT

This should get you started:

R4:

no ip route 10.1.1.1 255.255.255.0 20.1.24.254

ip route 10.1.1.0 255.255.255.0 20.1.24.254

PIX:

ip address outside 20.1.24.254 255.255.255.0

no static (inside,outside) 20.x.x.x.x.1.1 netmask 255.255.255.255 0 0

static (inside,outside) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0

access-list MYACLOUT permit icmp any any

no access-list MYACLOUT permit ip host 20.1.24.4 host 10.1.1.1

route outside 0.0.0.0 0.0.0.0