topic Re: PIX, server, ping problem... in Network Security

PIX, server, ping problem...

homeboarder8 — Wed, 13 Mar 2019 00:51:37 GMT

Okay I thought I had this problem solved but it seems I have a different problem all together. So here is my situation... I have two servers behind a PIX 501. The PIX has a static external IP, and both servers have their own static external IPs that are being forwarded through the PIX to local IPs. I can ping the PIX from an outside network, but I cannot ping either of the servers external IPs.

Any help will be appriciated here.

Thanks!

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 18:37:26 GMT

Just to give some more information, I have pptp set up for the external IP addresses on the servers. One I am connected through pptp I can ping the internal IP address. Could pptp be the problem?

Thanks.

Re: PIX, server, ping problem...

Alan Huseyin Kayahan — Mon, 17 Dec 2007 18:50:42 GMT

Hi Austin

Try this

access-list outside_access_in permit icmp any host externalIPofserver1

access-list outside_access_in permit icmp any host externalIPofserver2

Regards

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 18:58:05 GMT

Thanks for the response. I tried your recommendations and still I get the "Request timed out" message when trying to ping the servers.

Other ideas?

Just to clarify some things... I am able to PPTP & RDP to the servers. But I am not able to ping the external IP addresses from an external network.

Re: PIX, server, ping problem...

Alan Huseyin Kayahan — Mon, 17 Dec 2007 20:06:13 GMT

Please post your config

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 21:29:31 GMT

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxxxxxxxxxx encrypted

passwd xxxxxxxxxxxxx encrypted

hostname homeVOIP

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

object-group network pptp_servers

network-object host 74.xx.xx.55

network-object host 74.xx.xx.54

access-list inbound permit tcp any host 74.xx.xx.55 eq www

access-list inbound permit tcp any host 74.xx.xx.55 eq domain

access-list inbound permit udp any host 74.xx.xx.55 eq domain

access-list inbound permit tcp any host 74.xx.xx.55 eq pptp

access-list inbound permit tcp any host 74.xx.xx.54 eq pptp

access-list inbound permit tcp any host 74.xx.xx.54 eq www

access-list inbound deny ip any any log

access-list outbound permit ip 10.0.0.0 255.0.0.0 any

access-list outbound deny ip any any log

access-list acl_inbound permit tcp any object-group pptp_servers eq pptp

access-list acl_inbound permit gre any object-group pptp_servers

access-list acl-inbound permit udp any any eq domain

access-list acl-inbound permit udp any eq domain any

access-list acl-inbound permit tcp any any eq domain

access-list acl-inbound permit tcp any eq domain any

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 74.xx.xx.56 255.255.255.248

ip address inside 10.xx.xx.81 255.0.0.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 10.0.0.0 255.0.0.0 0 0

static (inside,outside) 74.xx.xx.55 10.xx.xx85 netmask 255.255.255.255 0 0

static (inside,outside) 74.xx.xx.54 10.xx.xx.84 netmask 255.255.255.255 0 0

access-group acl_inbound in interface outside

access-group outbound in interface inside

route outside 0.0.0.0 0.0.0.0 74.xx.xx.58 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

: end

Re: PIX, server, ping problem...

acomiskey — Mon, 17 Dec 2007 21:37:59 GMT

access-list acl-inbound permit icmp any host 74.xx.xx.55

access-list acl-inbound permit icmp any host 74.xx.xx.54

access-list outbound permit icmp any any echo-reply

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 21:43:59 GMT

I entered in the above yet I still cannot ping the external IP addresses. Even when I try to ping from the PIX I get "NO response received".

Other thoughts?

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 22:49:48 GMT

I'm just throwing stuff out there but could this have something to do with ARP? I did a "show arp" and noticed I there are some different IP addresses stored in there...

homeVOIP(config)# show arp

outside 74.xx.xx.58 0013.f746.d8e3

outside 74.xx.xx.57 0013.1011.2f09

inside 10.xx.xx.84 00c0.9f21.a901

Re: PIX, server, ping problem...

sbaddipu — Mon, 17 Dec 2007 23:31:59 GMT

Do you see the pings - echo requests on the server? Sometimes, I have seen office laptops (special images) are configured not to respond to pings? I ended up spending 2 hours debugging a similar issue.

Satya

Re: PIX, server, ping problem...

homeboarder8 — Mon, 17 Dec 2007 23:49:36 GMT

Yes I don't think it has anything to do with that. I can ping everything fine (the PIX, other external IP addresses) just not the 2 external IPs for the servers. I did some more debugging and noticed that I cannot ping OUT from the servers either. If you need any other information please let me know.

Thanks!

Re: PIX, server, ping problem...

acomiskey — Tue, 18 Dec 2007 00:29:23 GMT

To ping from inside to outside you will need...

access-list acl-inbound permit icmp any any echo-reply

access-list outbound permit icmp any any echo

Re: PIX, server, ping problem...

jfbeam — Tue, 18 Dec 2007 00:53:51 GMT

For starters, pick an access list name and stay with it. You have *3* "inbound" acl's defined: (1) inbound, (2) acl_inbound, and (3) acl-inbound. Notice the underscore vs. dash. "acl_inbound" (underscore) is the one that's active. This is why I dislike access-lists; call me old, but "conduit permit icmp any any" has never failed me.

Your outbound filter is unnecessary under normal circumstances. The access list ("outbound") doesn't have anything to block unless something on the internal network is screwed up. Unless management software complains about not having this filter, I'd remove it. People always forget they have to allow traffic in both directions. (Add a vote for conduits. *grin*)

Your inbound acl (and lets settle on "inbound") needs to allow icmp in (and the replies back out if there's a filter in the other direction.)

! "inbound"

clear access-list inbound

access-list inbound permit icmp any any

access-list inbound permit tcp any object-group pptp_servers eq domain

access-list inbound permit tcp any object-group pptp_servers eq www

access-list inbound permit tcp any object-group pptp_servers eq pptp

access-list inbound permit gre any object-group pptp_servers

access-group inbound in interface outside

As it stands, the outbound list will not prevent icmp traffic -- ip includes icmp.

If that still doesn't work, "conduit permit icmp any any" will. ('tho management software tends to complain about using conduits.)

Note about "conduit": Cisco depreciated conduits a long time ago. However, current versions of PDM (3.0+) don't complain about them and will actually create them. So, they aren't as Evil(tm) as Cisco once taught.

Re: PIX, server, ping problem...

homeboarder8 — Tue, 18 Dec 2007 01:53:08 GMT

Okay so from what I understand, I should delete the acls inbound and acl-inbound and replace them with the acl inbound above?

Thanks for your help!

Re: PIX, server, ping problem...

jfbeam — Tue, 18 Dec 2007 03:12:24 GMT

They're not being used, so they just take up space (and confuse people.) I rolled them all into "inbound".

And the domain line should be udp, not tcp.

access-list inbound permit udp any object-group pptp_servers eq domain

(tcp is only used for zone transfers.)

Re: PIX, server, ping problem...

Alan Huseyin Kayahan — Tue, 18 Dec 2007 08:03:03 GMT

Make sure software firewalls installed on server permit ICMP (Like windows firewall) try temporarily disabling then ping

Re: PIX, server, ping problem...

acomiskey — Tue, 18 Dec 2007 14:58:45 GMT

jfbeam, ip does not include icmp.

Re: PIX, server, ping problem...

homeboarder8 — Tue, 18 Dec 2007 15:26:09 GMT

Okay here is where I stand. I can now ping out from the server, but still I cannot ping the external IP addresses of either of the servers. Note that I am using a static route for the external IPs to the internal ones (Not sure if that makes any difference). But here is the updated running config:

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxxxxxxxxx encrypted

passwd xxxxxxxxxx encrypted

hostname homeVOIP

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

object-group network pptp_servers

network-object host 74.xx.xx.55

network-object host 74.xx.xx.54

access-list inbound permit icmp any any

access-list inbound permit udp any object-group pptp_servers eq domain

access-list inbound permit tcp any object-group pptp_servers eq www

access-list inbound permit tcp any object-group pptp_servers eq pptp

access-list inbound permit gre any object-group pptp_servers

access-list outbound permit ip 10.0.0.0 255.0.0.0 any

access-list outbound deny ip any any log

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 74.xx.xx.56 255.255.255.248

ip address inside 10.xx.xx.81 255.0.0.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 10.0.0.0 255.0.0.0 0 0

static (inside,outside) 74.xx.xx.55 10.xx.xx.85 netmask 255.255.255.255 0 0

static (inside,outside) 74.xx.xx.54 10.xx.xx.84 netmask 255.255.255.255 0 0

access-group inbound in interface outside

access-group outbound in interface inside

conduit permit icmp any any

route outside 0.0.0.0 0.0.0.0 74.xx.xx.58 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

: end

Thanks again for all the help.

Re: PIX, server, ping problem...

acomiskey — Tue, 18 Dec 2007 17:03:17 GMT

You have to allow the ping reply in your outbound acl since ip does NOT include icmp.

access-list outbound permit icmp any any

Re: PIX, server, ping problem...

homeboarder8 — Tue, 18 Dec 2007 20:17:21 GMT

Okay I entered that access-list in but I still cannot ping the external IP addresses...