PIX NAT denying ICMP and other Traffic for Remote Hosts

[dwrscisco]

I have PIX 6.3(3) with six interfaces configured with NAT. One of them is connected to DMZ2, in DMZ2 I have a router connected to a remote site's router.

CONFIGURATION:

NAT (dmz2) 1 0 0

global (dmz2) 1 interface

- there is no access-list nor NAT on the routers, i.e. when the packet received from the remote host at the PIX as the original source IP Address.

PROBLEM:

- The remote user is not able to receive replies to ICMP request to a host on the internet

- and it cannot sync with NTP server on the internet

SOLUTION (I don't want to do):

I have to do STATIC (dmz2,outside) ip_out ip_dmz2

for the remote host, to be able to get ICMP replies and sync to NTP servers on the internet.

Am I missing or misconfiguring a thing on the PIX ?

I don't want to use a separate global (internet) IP address for each and every remote PC that wants to connect to the internet...

Any advise. THANKS IN ADVANCE

Shamsan

[Patrick Iseli]

ICMP is not a stateful protocol.

1.) To permit icmp traffic traveling from one interface on an other interface on the PIX you need to permit that in the access-list. Of course in consideration with the security level.

2.) If you want to to be able to ping your own interface, that one that you are connected to.

You need to configure the " icmp " command.

Syntax: icmp permit|deny [host] src_addr

[src_mask] [type] int_name

SEE: Handling ICMP Pings with the PIX Firewall

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

sincerely

Patrick

[dwrscisco]

Hello Patrick,

Thanks for the info.

My problem is not with Allow or Deny, I can make the ICMP work very easly. I believe I have consfused readers with the ICMP example.

My problem is exactly with NTP, that the remote host is not able to Sync. with the NTP server on the internet.

I am able to solve this problem in one way only, which is by doing STATIC NAT on pix for this remote host to the outside word, i.e., he can Sync. with NTP server on internet and PING anywhere as well.

My problem I do not want to do STATIC NAT and start giving remote hosts Public IP Addresses (internet addresses) because this means for each and every remote host I have to buy an internet IP address to do NTP !!

I hope this clearifies the problem more.

Thanks,

Shamsan