Solved

Cannot Ping across ASA 5510 from Server 2008 - FIREWALL IS OFF

Posted on 2010-08-18
4
674 Views
Last Modified: 2012-08-14
I've got a strange one...

I have what can be described as a DMZ that is seperated from our main network by a Cisco ASA 5510.  Now, here's one strange item...this DMZ area is the *inside* and more secure.  Main network is the outside interface.  Inside has security of 100, outside=0.  

I have several Server 2003 machines in this DMZ.  I have the proper firewall rules to allow pings to and from both directions and this works as desired with all the 2003 boxes.  I've added my first Server 2008 box into this segment, compatible IP address.  It can see/ping all servers within the DMZ...but cannot ping across the ASA to anything in our main network as the 2003 boxes can.

The gateway for this segment is NOT via the ASA.  There is a router that provides the gateway.  Keep in mind...static routes are already in place for our main network through the ASA...and this works fine for all the 2003 boxes.  I've simply added a new IP address into the mix.  It doesn't work and the only glaring difference is that this is a Server 2008 box!

Before you ask... the Windows Firewall is OFF and the service is stopped on the 2008 box.
IPv6 is disabled.

Due to PCI requirements, I cannot post an ASA config here...sorry.  All I'm after is a pointer in the right direction as to why a Server 2008 box might behave differently from a 2003 box.  Of course, if there's something else that might cause this, I'm all ears!  Any ideas?
0
Comment
Question by:RickCurtis
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
anoopkmr earned 500 total points
ID: 33465514
with out seeing the firewall and the router config ? hmmm

1) did u add the proper nat commands on  asa ?
2) can u try the from the router to check the connectivity ?
3) from the inside segment , can you able to reach the firewall inside ip ?
4) from the DMZ can u reach the router IP ? ( gateway )
5) inside lan what is the gateway configired ?
6)  try with inspect icmp  in ASA
0
 

Author Comment

by:RickCurtis
ID: 33465597
1) We're not using NAT
2) From the ASA console I *can* ping a server in the main net
3) I can ping the inside interface from the 2008 box
4) Yes
5) Given in original info...a separate router...not the ASA
6) How do you do this?
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33465780
from the router can you ping the ASA ip ?
did u try from the router to reach other nework ?

did u add the command no nat-control ? by default asa is in no nat mode


policy-map global_policy
class inspection_default
inspect icmp
0
 

Author Closing Comment

by:RickCurtis
ID: 33467472
After re-checking, it was indeed a missing static-nat...
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

837 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question