VERY basic Pix 515E question

[_-TonyS-_]

I just pulled the thing out of the box and powered it up.

I put it on our internal network connected a laptop to the inside interface and went through the setup wizard.

I gave the outside interface a static address, added pat for the internal systems (just the above listed laptop) and all seemed well.

There appears to already be an access rule that allows all outbound traffic but I can see anything beyond the inside interface (192.168.1.1) on the laptop.

I can ping the whole world from the pix but the poor internal system sees nothing.

I am very new to Cisco and am sure I'm missing something basic.

Anyone want to help our a newbie?

Thanks!

[jason.aarons]

Does you laptop have a default gateway of the pix?

Does the pix have a "route 0.0.0.0 0.0.0.0" pointing to your ISP ?

[_-TonyS-_]

The laptop has a default gateway set to the inside interface of the Pix (192.168.1.1).

The Pix outside interface has the following static route:

Interface name: Outside

IP Address: 0.0.0.0

Gateway IP: 192.168.0.111 (The internal interface of our live firewall)

Mask: 0.0.0.0

Metric: 1

I THINK that the same as what you're asking.

[rthakker]

Is your Live firewall has route configured for 192.168.1.0 network?

## Assuming you have got outside network of Test firewall 192.168.0.0/24 and inside network 192.168.1.0/24. ##

( You already mentioned that on your laptop you have got default route pointing to inside interface and Pix got default router 192.168.0.111 (The internal interface of our live firewall) but if your Live firewall is not aware of 192.168.1.0 network then it will drop the packets. )

[Patrick Iseli]

First things to know is:

Without an access-list on the interface a higher level interface. eg inside, can access all other lower interfaces as outside.

Second thing to know is:

ICMP is not a stateful protocol. To allow pings from the inside to the outside interface you need to create an access-list.

If you want to ping the same interface that you are physicly connected you need to configure the "icmp" command.

example:

See: Handling ICMP Pings with the PIX Firewall

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

The PIX and the traceroute Command

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800e9312.shtml

examples:

Traveroute

Microsoft:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

access-list 101 permit icmp any host YourPublicIP echo-reply

UNIX:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

ICMP command example

icmp deny any outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host 192.168.1.30 echo inside

icmp permit host 192.168.1.31 echo inside

icmp permit host 192.168.1.20 echo inside

icmp permit host 192.168.1.40 echo inside

icmp permit host 192.168.1.100 echo inside

sincerely

Patrick

[rthakker]

also apply this access list

icmp permit any echo outside

icmp permit any echo-reply outside

icmp permit any echo inside

icmp permit any echo-reply inside

[_-TonyS-_]

Do I need to do anything to apply these access lists besides type the command at the pix(config)# prompt?

Because they don't seem to have any effect.

[_-TonyS-_]

Ok, just typing the commands at the console has no effect but I'm assuming there is some way to 'apply' access lists that I'm overlooking?

[Patrick Iseli]

You have to be in config mode.

enable

conf t

access-list outside permit icmp any host YourPublicIP unreachable

access-list outside permit icmp any host YourPublicIP time-exceeded

access-list outside permit icmp any host YourPublicIP echo-reply

access-group outside in interface outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host YourPCsIP echo inside

exit

write mem

show access-list outside

Note: when you start pinging the hitcount behind the access-list is growing.

##################################################

Please Post your config, just remove your Public IP.

###################################################

sincerely

Patrick

[_-TonyS-_]

pixfirewall(config)#show config

: Saved

: Written by enable_15 at 06:41:15.021 UTC Tue Jan 18 2005

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 auto

interface ethernet2 auto shutdown

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

enable password xxxx

passwd xxxx

hostname pixfirewall

domain-name xxxxxx.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

icmp permit any echo outside

icmp permit any echo-reply outside

icmp permit host 192.168.1.2 echo outside

icmp permit any echo insideicmp permit any echo-reply inside

icmp permit host 192.168.1.2 echo inside

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside 192.168.0.107 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

no ip address intf2

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 10 interface

nat (inside) 10 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 192.168.0.111 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 inside

dhcpd dns 192.168.0.250

dhcpd wins 192.168.0.250

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd domain xxxxxx.com

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:xxxx

pixfirewall(config)#

[_-TonyS-_]

FYI:

I'm not sure if this changes anything but the laptop connected to the inside interface has NO access outside of the PIX firewall.

I can't ping, can't access http, ftp, smtp, snmp,smb, nothing.

I can however ping the inside interface of the pix (192.168.1.1) and can bring up the https configuration website (also 192.168.1.1).

[zroth]

O.K.You can ping inside PIX interface (192.168.1.1) from your laptop.

The next step : try to ping the live firewall (PIX default gateway - 192.168.0.111,I suppose).

Start icmp debug on the PIX with the command debug icmp trace

You should see outgoing ICMP packets at least.

HTH

Zdenek

[_-TonyS-_]

With the ICMP trace on the pix, i see nothing when trying to ping 192.168.0.111 from the laptop. I see information when I ping 192.168.0.111 from the PIX but I was always able to ping from the PIX.

Is there some sort of trace I can turn on to see where exactly the PIX is dropping the packets coming from the laptop?

[zroth · Accepted solution]

Hi,

you can watch traffic on any interface by applying

the folloving command

capture (name of capture) int (name of interface)

through the command show capt (name of capture) you

see the captured packets on that interface

Example : I want to watch traffic on inside interface

In privileged mode (#) type capture tony interface inside

then show capture tony

In this case you should see incoming ICMP echo packets from the laptop.(I do not believe they are coming,I suppose you have not the route to the network 192.168.0.0 (or just default route over 192.168.1.1 - and only one !)in your laptop).Try route print command on the laptop to check it.

ICMP commands in your configuration are not ACL commands,they only control ICMP access to the PIX

interfaces,not ICMP through PIX.

Therefore I do not think you can succesfully ping

192.168.0.111,but ICMP echo packets should leave

the PIX outside interface and the ICMP echo-reply

packets from 192.168.0.111 would be stopped at this

interface by ping return.This could be watched in

PIX log (show logg).You must start logging in configuration by

conf t

logg on

logg buff 7

You can also apply capture on outside interface !!

To achieve return of ping packets from 192.168.0.111 you have to apply an access-list on outside PIX interface .As written in previous post.

HTH

Zdenek

[_-TonyS-_]

Hey, thanks everyone (especially Zdenek) for the great info.

I was able to uncover that for whatever reason the PIX was not handing out route information to the laptop on the internal interface. The following command fixed the issue:

route outside 0.0.0.0 0.0.0.0 192.168.0.111 1

Thanks Everyone!