Trace result with PIX

[prasadkrishna]

The Trace from the internal network does not show the inside interface in the hops. The first hop is the internal Firewall and the second is the perimeter router connected to the Outside interface.

Can anybody clarify on this ??

[Patrick Iseli]

Does that device allow ICMP and which icmp commands ? Do we talk about a PIX or an IOS Firewall ?

For PIX:

Handling ICMP Pings with the PIX Firewall

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

The PIX and the traceroute Command

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800e9312.shtml

sincerely

Patrick

[prasadkrishna]

Yes. The device allows ICMP. Im talking of the PIX ver6.3

infact im able to do a PING and Trace from the inside host to the outside network.

Regards

Prasad

[Patrick Iseli]

To ping or trace the from the inside network to the inside interface you need to configure the "ICMP" command.

example:

ICMP command example

icmp deny any outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host 192.168.1.30 echo inside

icmp permit host 192.168.1.31 echo inside

icmp permit host 192.168.1.20 echo inside

icmp permit host 192.168.1.40 echo inside

icmp permit host 192.168.1.100 echo inside

sincerely

Patrick