Cannot ping a floating IP-- PIX 515E

gomesrichard · ‎01-04-2003

Hi All.

We are facing some problem with floating IP address which is actually

a package IP in HP cluster environment.

HP servers-------PIX-------NAS-------PC client

1) PIX arp table has 2 entry for main HP server lan0 and virtual IP,

but there mac table is the same( which is lan0's mac address).

All the PC client are in different subnet from HP server. Problem is

that we can ping IP addresses of HP server's( main and failover) lan0

but cannot ping the virtual IP address of configured package. Within the HP server's subnet, we can ping all the IP addresses( both lan0 and

virtual IP) from HP server and also from PIX. NAs can ping both HP's main and failover server's lan0 IP address, but cannot ping the virtual/package IP address of the cluster package.

What is the problem?

Thanks and regards

Richard Gomes

p-hogan · ‎01-04-2003

Can the inside clients use actual services on HPs via the lan0 address?

Ping is sometimes a bit confusing through a firewall

If you clear the arp in the PIX and ping the virtual again, it should have a virtual ip and mac, does the HP generate a virtual mac?

gomesrichard · ‎01-04-2003

No, hp does not generate virtual mac and I tried with clearing arp table in the PIX, but it did not help.

Thanks

RIchard

p-hogan · ‎01-04-2003

do the local users on the same network as the HPs have the same in their arp table - 2 x IPs and 1 mac?

do you have an access-list or conduit command to allow pings back trough the outside interface on the PIX?

gomesrichard · ‎01-04-2003

Hi Hogan,

I have to check the mac table( new idea!) of the same subnet's client.

And Yes, I have an access-list which permits ip any any( from any source to any destination).

Thanks for your response.......

richard

p-hogan · ‎01-05-2003

the access-list statements should allow icmp as well as ip

e.g.

access-list acl_outside permit ICMP 'source' destination'

b-pelphrey · ‎01-06-2003

agree with p-hogan, icmp is different from any ip. but i am a bit confused on why the host can't access any services on the hp system??

maybe several things going on here.