I got a Huge Grane waiting for remote thousands miles away !!
I'm trying to access from the outside interface using ping from a router 172.24.16.5, where there is a ip route 172.24.16.8 255.255.255.255 172.24.16.7
The device i'm trying to ping is on the inside side of the pix and has ip of 10.10.10.175 and responds to ping from the PIX
the router 172.24.16.5 on the outside side of the pix also reponds to pings from the pix
Enabling debug iCMP trace and pinging 172.24.16.8 from the router 172.24.16.5 i do get the following messages ----------------------------------------------------------------------------------------------------
macaefw2# debug icmp trace ICMP trace on Warning: this may cause problems on busy networks macaefw2# 102: ICMP echo-request from outside:172.24.16.5 to 172.24.16.8 ID=56 seq=0 length=80 103: ICMP echo-request: untranslating outside:172.24.16.8 to inside:10.10.10.175 104: ICMP echo-request from outside:172.24.16.5 to 172.24.16.8 ID=56 seq=1 length=80 105: ICMP echo-request: untranslating outside:172.24.16.8 to inside:10.10.10.175
From the sh log enabled i do see --------------------------------
605005: Login permitted from 172.22.20.142/3876 to outside:172.24.16.7/ssh for user "acergy" 111008: User 'enable_15' executed the 'debug icmp trace' command. 106100: access-list acl_outside permitted icmp outside/172.24.16.5(0) -> inside/172.24.16.8(8) hit-cnt 1 (first hit)
Also doing sh Xlate i see ---------------------------
1 in use, 1 most used Global 172.24.16.8 Local 10.10.10.175
The full configuration is below. Can you please tell me why ping does not work? -------------------------------------------------------------------------------
PIX Version 6.3(4) interface ethernet0 10baset interface ethernet1 10baset nameif ethernet0 inside security100 nameif ethernet1 outside security0 enable password 2KFQnbNIdI.2KYOU encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname macaefw2 domain-name XXXXXX.com no fixup protocol dns fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol icmp error fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list compiled access-list acl_outside permit udp any any eq isakmp access-list acl_outside permit udp any eq isakmp any access-list acl_outside permit udp any any eq 4500 access-list acl_outside permit udp any eq 4500 any access-list acl_outside permit esp any any access-list acl_outside permit ah any any access-list acl_outside permit icmp any any log 7 access-list acl_outside permit icmp any host 172.24.16.8 access-list acl_outside permit ip any host 172.24.16.8 access-list acl_outside permit tcp any host 172.24.16.8 access-list acl_outside permit udp any host 172.24.16.8 access-list acl_outside permit ip 172.22.0.0 255.255.0.0 host 172.24.16.8 pager lines 24 logging on logging monitor alerts logging buffered debugging icmp permit any inside icmp permit any outside mtu inside 1500 mtu outside 1500 ip address inside 10.10.10.172 255.255.255.0 ip address outside 172.24.16.7 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 10.10.10.175 255.255.255.255 inside pdm location 10.10.10.176 255.255.255.255 inside pdm location 10.10.10.177 255.255.255.255 inside pdm location 10.10.10.178 255.255.255.255 inside pdm location 172.22.0.0 255.255.252.0 outside pdm location 172.22.0.0 255.255.0.0 outside pdm location 172.24.0.0 255.255.0.0 outside pdm history enable arp timeout 14400 static (inside,outside) 172.24.16.8 10.10.10.175 netmask 255.255.255.255 0 0 static (inside,outside) 172.24.16.9 10.10.10.176 netmask 255.255.255.255 0 0 access-group acl_outside in interface outside route outside 0.0.0.0 0.0.0.0 172.24.16.5 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa authentication ssh console LOCAL http server enable http 172.22.0.0 255.255.0.0 inside http 172.24.0.0 255.255.0.0 inside http 172.22.0.0 255.255.0.0 outside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set aber-mac-set esp-des esp-md5-hmac isakmp policy 1 authentication rsa-sig isakmp policy 1 encryption des isakmp policy 1 hash sha isakmp policy 1 group 1 isakmp policy 1 lifetime 86400 telnet 10.10.10.0 255.255.255.0 outside telnet 172.24.0.0 255.255.252.0 outside telnet timeout 5 ssh 172.22.0.0 255.255.0.0 inside ssh 172.22.0.0 255.255.0.0 outside ssh timeout 5 console timeout 0
