PIX configuration

We have 2 PIX FW:  515 and 515E.  They both work OK when connected to Verizon (ISP).
But when we switch to AT&T (ISP), only 515 works, but not 515E, even we use the same template.
Our Network:  Inside LAN ---- PIX 515E --  AT&T Router ---  Internet
We can ping any IPs on the Internet from the firewall but not from the Inside LAN.
Thank you.

Tac
Template.txt
TachuynhAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

batry_boyCommented:
When you switch the 515 with the 515E, did you power cycle the AT&T router to clear its ARP cache?  You may even need to clear the ARP cache on the internal switch that the inside PIX interface is attached to.
0
TachuynhAuthor Commented:
Hi Batry Boy,
Thank you very much for your help.  Last time I did recycle the AT&T router but not the Switch, I will try it nest time.
Besises do I have to use the command " Clear Xlate" on the PIX?
Thanks.

Tac
0
batry_boyCommented:
You only have to do a "clear xlat" on the PIX when you modify any of the existing translations (add/delete/modify).  When you put one PIX in place after bringing down the other one, you are automatically clearing the translation table because I assume that you are power cycling the PIX.  If this is not the case, then you can issue the "clear xlat" command to see if it helps.

When you have the 515E in place, can you ping an Internet host from the PIX itself?
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

TachuynhAuthor Commented:
Yes, when I have the PIX 515E connected, from  the PIX I can ping any Internet host but not from the Inside LAN.
One more thing from the Inside LAN I can ping some host in the DMZ but not all.

Thanks.

Tac

0
batry_boyCommented:
Try adding this statement and test pinging to the Internet again from the inside LAN:

access-list outside_access_in permit icmp any any echo-reply

You can do the same for the DMZ as well, if you wish:

access-list inet permit icmp any any echo-reply
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TachuynhAuthor Commented:
I will try all your advices tonight @6 PM PCt and will let you know the result.

Again thank you very much

Tac
0
TachuynhAuthor Commented:
Hi Batry Boy,

This evening, based on your advice,  I cleared all ARP cache on the AT&T router, our internal HP and DMZ switches  then everything looked good, The PIX worked OK.
Thank you very much,  I sincerely appreciate your expertise.
I think we will need more help from you in the future if you don't mind.
Tac
818-441-1869 (c)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.