Hello, I am running a Cisco Pix 515 firewall with the latest IOS
and a Cisco Catalyst Switch 2950, with the latest IOS.
Port 1 is on the switch as a trunk for Vlan 10 and 20.
Port 2 are VLAN10
Port 6 VLAN 20
VLAN10 = 192.168.10.0 Client 192.168.10.10 255.255.255.0
VLAN20 = 192.168.20.0 Client 192.168.20.20 255.255.255.0
On the PIX, the external interface is connected to my FritzBox.
IP of the Outside Interface on the Pix 192.168.178.2 255.255.255.0
Route: Interface Outside 0.0.0.0 0.0.0.0 192.168.178.1
There are 2 subinterfaces on interface 2 that are handled.
On the Pix
1. SubInt = 192.168.10.1 255.255.255.0
2. SubInt = 192.168.20.1 255.255.255.0
Nat rules were heard.
Both clients, one in the vlan10 and the other in the vlan20,
can access the Internet via the PIX Peer NAT.
Unfortunately, the ping between the two clients does not work.
Rules were also taken into account.
Windows Firewall is switched off
Switch Config:
Switch#show running-config
Building configuration...
Current configuration : 1550 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
switchport trunk allowed vlan 10,20
switchport mode trunk
!
interface FastEthernet0/2
switchport access vlan 10
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
switchport access vlan 20
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan10
no ip address
!
interface Vlan20
no ip address
!
ip http server
!
line con 0
line vty 0 4
login
line vty 5 15
login
!
!
end
Switch#
PIX Config:
: Saved
:
PIX Version 8.0(4)23
!
hostname pixfirewall
domain-name PIX
enable password axb3wREqWJcNiySG encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.178.2 255.255.255.0
ospf cost 10
!
interface Ethernet1
shutdown
nameif inside
security-level 100
no ip address
ospf cost 10
!
interface Ethernet2
no nameif
security-level 100
no ip address
!
interface Ethernet2.10
vlan 10
nameif Vlan10
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface Ethernet2.20
vlan 20
nameif Vlan20
security-level 100
ip address 192.168.20.1 255.255.255.0
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
dns server-group DefaultDNS
domain-name PIX
access-list outside_access_in extended permit ip any any
access-list SubVLan20_access_in extended permit ip any any
access-list SubVLan20_access_in extended permit icmp any any
access-list SubVlan10_access_in extended permit ip any any
access-list SubVlan10_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
access-list Vlan20_access_in extended permit ip any any
access-list Vlan20_access_in_1 extended permit ip any any
access-list Vlan20_access_in_1 extended permit icmp any any
access-list Vlan10_access_in extended permit ip any any
access-list Vlan10_access_in extended permit icmp any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu Vlan10 1500
mtu Vlan20 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 192.168.178.100-192.168.178.110 netmask 255.255.255.0
global (outside) 1 192.168.178.99 netmask 255.255.255.0
nat (Vlan10) 1 192.168.10.0 255.255.255.0
nat (Vlan20) 1 192.168.20.0 255.255.255.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group Vlan10_access_in in interface Vlan10
access-group Vlan20_access_in_1 in interface Vlan20
route outside 0.0.0.0 0.0.0.0 192.168.178.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.10.10 255.255.255.255 Vlan10
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 192.168.10.10 255.255.255.255 Vlan10
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username runner password oSxq6Zotq9senXtp encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:cd5dbfe8caa446ca873496c96dedab1c
: end
no asdm history enable
Could anyone help me, please
