Solved

Cannot Ping across ASA 5510 from Server 2008 - FIREWALL IS OFF

Posted on 2010-08-18
4
679 Views
Last Modified: 2012-08-14
I've got a strange one...

I have what can be described as a DMZ that is seperated from our main network by a Cisco ASA 5510.  Now, here's one strange item...this DMZ area is the *inside* and more secure.  Main network is the outside interface.  Inside has security of 100, outside=0.  

I have several Server 2003 machines in this DMZ.  I have the proper firewall rules to allow pings to and from both directions and this works as desired with all the 2003 boxes.  I've added my first Server 2008 box into this segment, compatible IP address.  It can see/ping all servers within the DMZ...but cannot ping across the ASA to anything in our main network as the 2003 boxes can.

The gateway for this segment is NOT via the ASA.  There is a router that provides the gateway.  Keep in mind...static routes are already in place for our main network through the ASA...and this works fine for all the 2003 boxes.  I've simply added a new IP address into the mix.  It doesn't work and the only glaring difference is that this is a Server 2008 box!

Before you ask... the Windows Firewall is OFF and the service is stopped on the 2008 box.
IPv6 is disabled.

Due to PCI requirements, I cannot post an ASA config here...sorry.  All I'm after is a pointer in the right direction as to why a Server 2008 box might behave differently from a 2003 box.  Of course, if there's something else that might cause this, I'm all ears!  Any ideas?
0
Comment
Question by:RickCurtis
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
anoopkmr earned 500 total points
ID: 33465514
with out seeing the firewall and the router config ? hmmm

1) did u add the proper nat commands on  asa ?
2) can u try the from the router to check the connectivity ?
3) from the inside segment , can you able to reach the firewall inside ip ?
4) from the DMZ can u reach the router IP ? ( gateway )
5) inside lan what is the gateway configired ?
6)  try with inspect icmp  in ASA
0
 

Author Comment

by:RickCurtis
ID: 33465597
1) We're not using NAT
2) From the ASA console I *can* ping a server in the main net
3) I can ping the inside interface from the 2008 box
4) Yes
5) Given in original info...a separate router...not the ASA
6) How do you do this?
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33465780
from the router can you ping the ASA ip ?
did u try from the router to reach other nework ?

did u add the command no nat-control ? by default asa is in no nat mode


policy-map global_policy
class inspection_default
inspect icmp
0
 

Author Closing Comment

by:RickCurtis
ID: 33467472
After re-checking, it was indeed a missing static-nat...
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question