I cant ping my net

Posted on 2008-11-15
Last Modified: 2012-05-05
i have 2 network 1 is internet, and another is a point to point 10.191.56.x to another places

i have a pix making nat a distributed traffic is the address is a 10.x.x.x go to my gateway 10.x.x.1 and is it internet go to my other router... but the problem is i cant ping the 10.x.x.x from my hosts...
if i try to ping 10.x.x.x from my pix is all ok go to router and ping correct, but if i try with my windows XP is impossible to ping the same host
any help?

Building configuration...
: Saved
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname GW-01534
domain-name ad01534
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm location inside
pdm location outside
pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 0 0
route outside 1
route inside 2
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80

: end

Question by:pablouruguay
    LVL 15

    Accepted Solution


    Try this command to allow icmp traffic to these networks:

    access-list acl_in extended permit icmp any any

    Then apply the access list to the inside interface:

    access-group acl_in extended in interface inside

    The access group command must match the name of the access list

    LVL 14

    Author Comment

    no the same problem, i can ping 10.x.x.x. from firewall but not of any of my hosts inside network
    LVL 14

    Author Comment

    mmm i resolv the problem add manually a persistant route in the host
    route add mask -p

    but pix can do that to any host? in the dhcp maybe or in other way?
    LVL 15

    Expert Comment

    try a route print on one of the xp workstations to check the routing table for this network that cannot be pinged
    Are there any firewalls on the xp machines blocking icmp ?
    LVL 15

    Expert Comment

    then you need to look in your routers to find out why the default gateway of these xp workstation cannot reach this network

    what happens with a traceroute query?
    LVL 14

    Author Comment

    like i post in the post below,    i need to pix do a persistant route in the host is that possible?
    LVL 15

    Expert Comment

    You can do that, but you need to really look at the routing tables. Can servers in this subnet ping these hosts? Does the dhcp scope have the correct default gateway?  Are you using dynamic routing protocols such as eigrp or ospf so the routing tables can see all networks?
    LVL 14

    Author Comment

    i dont use dynamic routing, is a simple network with 2 gateways ... 1 internet, 1 intranet

    all traffic 10.x.x.x goes to my router all the other traffic goes to internet

    but in the hosts i cant ping my servers internally 10.x.x.x trough my router. but pix can ping all my intranet. i only need the pix give a persistant route to the hsots.
    LVL 15

    Expert Comment

    If you have checked your routing tables and a route exists for these hosts to the servers, then something (firewall) is blocking icmp on these machines. If the firewall allows for icmp traffic, then pings should work. If they are win xp machines, then  try opening icmp traffic throught the firewall using the netsh command

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    Suggested Solutions

    This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
    This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
    This video discusses moving either the default database or any database to a new volume.
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now