PIX 501 cannot access anything from E1 to E0

[revahi]

Hello all.

I have 1 ADSL router using its own NAT and PAT sitting between the ADSL point and E0. PC host on E1 unable to ping to the router on E0.

Config of PIX as below:

PIX Version 6.2(2)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname pixfirewall

domain-name hamodia.co.uk

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

access-list acl_in permit icmp any any

access-list acl_out permit icmp any any

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside 192.168.0.1 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 192.168.1.3 255.255.255.255 inside

pdm history enable

arp timeout 14400

nat (inside) 0 0.0.0.0 0.0.0.0 0 0

access-group acl_in in interface outside

access-group acl_out in interface inside

route outside 0.0.0.0 0.0.0.0 192.168.0.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.1.3 255.255.255.255 inside

http 0.0.0.0 0.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

no sysopt route dnat

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh timeout 5

terminal width 80

Config of PC:

Ethernet adapter Local Area Connection:

Description . . . . . . . . . . . : 3Com EtherLink 10/100 PCI TX NIC (3C905B-TX)

Physical Address. . . . . . . . . : 00-50-DA-E0-1E-CC

Dhcp Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.3

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

DNS Servers . . . . . . . . . . . : 158.43.240.3 DNS2 158.43.240.4

I've also added a static route in the router on E0 as destination IP that of E1 and gateway IP that of E0 with a metric of 1 (no other router in between either interface) and a subnet first tried 255.255.255.255 which I thought means connection to host only and then 255.255.255.0 but unable to ping anything on E0 nor does the PC connect to the internet when the router is on E0. It only works when router's on E1 but I suppose that defeats the purpose of the PIX.

From the console I am able to ping both interfaces.

[tvanginneken]

Hi,

since you are using the NAT0 statement, I suppose you don't want any address translation for packets originating from the inside network and going to the outside.

But the NAT0 statement should only be used for VPN config to specify which traffic should not be translated and sent into the VPN tunnel.

In your setup, you should use the 'static' command instead, with two times the same network address. Like this:

static (inside,outside) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

Secondly, the access-list on the inside interface only allows icmp originating to the outside. All other traffic is implicitly dropped. Is that really what you want? By default all traffic from the inside to the outside is allowed, so you should not have to apply an access-list to the inside interface if you want to allow all traffic from the inside to the outside.

Kind Regards,

Tom

[revahi]

I am using the NAT0 statement because a router attached to E0 does its own nat to the Internet.

I've cleared the access list and added the static statement.

The host still can't ping the router on E0.

Is that becuase either the outside or the inside interface doesn't allow inbound ICMP traffic?

Is there a way around this seeing as access-lists and groups don't do anything to inbound ICMP traffic?

I have also static a static route on this router pointing to the IP of E1 with the gateway set to the IP on E0.

Thank you so far for your reponse.

Isaac

[tvanginneken]

Hi,

for icmp connectivity, there should only be an access-list applied to the outside interface of the pix. This access-list should allow icmp reply traffic. Did you also remove the NAT0 statement? The static command should replace the nat0 command.

Could you try a traceroute on an inside host and on the router to see that the correct route is followed.

Kind Regards,

Tom

[revahi]

I've added the following statements for ICMP return traffic:

icmp permit any echo-reply outside

icmp permit any information-reply outside

icmp permit any mask-reply outside

icmp permit any parameter-problem outside

icmp permit any source-quench outside

icmp permit any time-exceeded outside

icmp permit any timestamp-reply outside

icmp permit any unreachable outside

icmp deny any outside

access-list ping_reply permit icmp any any echo-reply

access-group ping_reply in interface outside

I've added the following static statement

static (inside,outside) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0

and then executed

clear nat

write mem

reload

The traceroute and ping to the router both time out but since adding the static

command Internet Access has now been possible even before clearing the

NAT0 command.

I'm a bit confused here, I assumed that the static command is to allow internet users (legitamate) access to a system on the inside such as a web server?

Kind regard

Isaac

[tvanginneken]

Hi Isaac,

this command:

static (inside,outside) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0

has the same effect as the NAT0 command. Both the commands just make sure that the inside addresses are not translated. You should always use the static version, unless you are configuring VPN.

Kind Regards,

Tom

[revahi]

Hi Tom,

could you tell me why the static command is better and why NAT0 is to be used instead for VPN?

Or perhaps point me to link where this would be discussed.

Thank you