topic Re: Cannot ping a floating IP-- PIX 515E in Network Security

Cannot ping a floating IP-- PIX 515E

gomesrichard — Fri, 21 Feb 2020 06:28:16 GMT

Hi All.

We are facing some problem with floating IP address which is actually

a package IP in HP cluster environment.

HP servers-------PIX-------NAS-------PC client

1) PIX arp table has 2 entry for main HP server lan0 and virtual IP,

but there mac table is the same( which is lan0's mac address).

All the PC client are in different subnet from HP server. Problem is

that we can ping IP addresses of HP server's( main and failover) lan0

but cannot ping the virtual IP address of configured package. Within the HP server's subnet, we can ping all the IP addresses( both lan0 and

virtual IP) from HP server and also from PIX. NAs can ping both HP's main and failover server's lan0 IP address, but cannot ping the virtual/package IP address of the cluster package.

What is the problem?

Thanks and regards

Richard Gomes

Re: Cannot ping a floating IP-- PIX 515E

p-hogan — Sat, 04 Jan 2003 16:08:48 GMT

Can the inside clients use actual services on HPs via the lan0 address?

Ping is sometimes a bit confusing through a firewall

If you clear the arp in the PIX and ping the virtual again, it should have a virtual ip and mac, does the HP generate a virtual mac?

Re: Cannot ping a floating IP-- PIX 515E

gomesrichard — Sat, 04 Jan 2003 16:19:19 GMT

No, hp does not generate virtual mac and I tried with clearing arp table in the PIX, but it did not help.

Thanks

RIchard

Re: Cannot ping a floating IP-- PIX 515E

p-hogan — Sat, 04 Jan 2003 16:41:19 GMT

do the local users on the same network as the HPs have the same in their arp table - 2 x IPs and 1 mac?

do you have an access-list or conduit command to allow pings back trough the outside interface on the PIX?

Re: Cannot ping a floating IP-- PIX 515E

gomesrichard — Sun, 05 Jan 2003 02:17:32 GMT

Hi Hogan,

I have to check the mac table( new idea!) of the same subnet's client.

And Yes, I have an access-list which permits ip any any( from any source to any destination).

Thanks for your response.......

richard

Re: Cannot ping a floating IP-- PIX 515E

p-hogan — Sun, 05 Jan 2003 10:45:59 GMT

the access-list statements should allow icmp as well as ip

e.g.

access-list acl_outside permit ICMP 'source' destination'

Re: Cannot ping a floating IP-- PIX 515E

b-pelphrey — Mon, 06 Jan 2003 21:12:50 GMT

agree with p-hogan, icmp is different from any ip. but i am a bit confused on why the host can't access any services on the hp system??

maybe several things going on here.