topic Ping Static device behind Pix in Network Security

Ping Static device behind Pix

pgagnon — Fri, 21 Feb 2020 06:21:43 GMT

I have a site to site VPN set up. On the remote end is a Pix 501 3DES 10 user.

Inside address is 10.25.99.1 and it is running dhcp for 10.25.99.10 thru 10.25.99.19.

I only have 3 users behind that device. I have a network attached printer that is at 10.25.99.20 and it is not reachable from anywhere except the local lan that has the Pix on it. This limitation should be easy to overcome but I haven't found the solution yet..... any ideas?

Re: Ping Static device behind Pix

hatfieldphilips.com — Fri, 08 Nov 2002 00:49:46 GMT

I’m not a PIX expert but here is my suggestion. Be sure you aren’t trying to run NAT through your IPSec tunnel and that you are able to send data back and forth between the subnets. You should be able to accomplish this by adding a couple of NAT statements and a simple access-list to route between the networks. See example:

Location #1

nat (inside) 0 access-list 100

nat (inside) 1 192.168.1.0 255.255.255.0 0 0

access-list 100 permit ip 192.168.1.0 255.255.0.0 10.25.99.0 255.255.0.0

Location #2

nat (inside) 0 access-list 100

nat (inside) 1 10.25.99.0 255.255.255.0 0 0

access-list 100 permit ip 10.25.99.0 255.255.255.0 192.168.1.0 255.255.255.0

Re: Ping Static device behind Pix

pgagnon — Fri, 08 Nov 2002 17:21:41 GMT

That is exactly how I am set up. The only pingable addresses behind the pix 501 are the pc's that lease an address from the pix over dhcp. PC's on that subnet can ping everything inside the subnet, static or otherwise.