?
Solved

PIX configuration

Posted on 2008-01-24
8
Medium Priority
?
881 Views
Last Modified: 2011-10-19
We have 2 PIX FW:  515 and 515E.  They both work OK when connected to Verizon (ISP).
But when we switch to AT&T (ISP), only 515 works, but not 515E, even we use the same template.
Our Network:  Inside LAN ---- PIX 515E --  AT&T Router ---  Internet
We can ping any IPs on the Internet from the firewall but not from the Inside LAN.
Thank you.

Tac
Template.txt
0
Comment
Question by:Tachuynh
  • 4
  • 3
7 Comments
 
LVL 28

Expert Comment

by:batry_boy
ID: 20738196
When you switch the 515 with the 515E, did you power cycle the AT&T router to clear its ARP cache?  You may even need to clear the ARP cache on the internal switch that the inside PIX interface is attached to.
0
 

Author Comment

by:Tachuynh
ID: 20738304
Hi Batry Boy,
Thank you very much for your help.  Last time I did recycle the AT&T router but not the Switch, I will try it nest time.
Besises do I have to use the command " Clear Xlate" on the PIX?
Thanks.

Tac
0
 
LVL 28

Expert Comment

by:batry_boy
ID: 20738463
You only have to do a "clear xlat" on the PIX when you modify any of the existing translations (add/delete/modify).  When you put one PIX in place after bringing down the other one, you are automatically clearing the translation table because I assume that you are power cycling the PIX.  If this is not the case, then you can issue the "clear xlat" command to see if it helps.

When you have the 515E in place, can you ping an Internet host from the PIX itself?
0
Turn Raw Data into a Real Career

There’s a growing demand for qualified analysts who can make sense of Big Data. With an MS in Data Analytics, you can become the data mining, management, mapping, and munging expert that today’s leading corporations desperately need.

 

Author Comment

by:Tachuynh
ID: 20738514
Yes, when I have the PIX 515E connected, from  the PIX I can ping any Internet host but not from the Inside LAN.
One more thing from the Inside LAN I can ping some host in the DMZ but not all.

Thanks.

Tac

0
 
LVL 28

Accepted Solution

by:
batry_boy earned 2000 total points
ID: 20738617
Try adding this statement and test pinging to the Internet again from the inside LAN:

access-list outside_access_in permit icmp any any echo-reply

You can do the same for the DMZ as well, if you wish:

access-list inet permit icmp any any echo-reply
0
 

Author Comment

by:Tachuynh
ID: 20738664
I will try all your advices tonight @6 PM PCt and will let you know the result.

Again thank you very much

Tac
0
 

Author Comment

by:Tachuynh
ID: 20740592
Hi Batry Boy,

This evening, based on your advice,  I cleared all ARP cache on the AT&T router, our internal HP and DMZ switches  then everything looked good, The PIX worked OK.
Thank you very much,  I sincerely appreciate your expertise.
I think we will need more help from you in the future if you don't mind.
Tac
818-441-1869 (c)
0

Featured Post

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question