Solved

Cannot Ping across ASA 5510 from Server 2008 - FIREWALL IS OFF

Posted on 2010-08-18
4
675 Views
Last Modified: 2012-08-14
I've got a strange one...

I have what can be described as a DMZ that is seperated from our main network by a Cisco ASA 5510.  Now, here's one strange item...this DMZ area is the *inside* and more secure.  Main network is the outside interface.  Inside has security of 100, outside=0.  

I have several Server 2003 machines in this DMZ.  I have the proper firewall rules to allow pings to and from both directions and this works as desired with all the 2003 boxes.  I've added my first Server 2008 box into this segment, compatible IP address.  It can see/ping all servers within the DMZ...but cannot ping across the ASA to anything in our main network as the 2003 boxes can.

The gateway for this segment is NOT via the ASA.  There is a router that provides the gateway.  Keep in mind...static routes are already in place for our main network through the ASA...and this works fine for all the 2003 boxes.  I've simply added a new IP address into the mix.  It doesn't work and the only glaring difference is that this is a Server 2008 box!

Before you ask... the Windows Firewall is OFF and the service is stopped on the 2008 box.
IPv6 is disabled.

Due to PCI requirements, I cannot post an ASA config here...sorry.  All I'm after is a pointer in the right direction as to why a Server 2008 box might behave differently from a 2003 box.  Of course, if there's something else that might cause this, I'm all ears!  Any ideas?
0
Comment
Question by:RickCurtis
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
anoopkmr earned 500 total points
ID: 33465514
with out seeing the firewall and the router config ? hmmm

1) did u add the proper nat commands on  asa ?
2) can u try the from the router to check the connectivity ?
3) from the inside segment , can you able to reach the firewall inside ip ?
4) from the DMZ can u reach the router IP ? ( gateway )
5) inside lan what is the gateway configired ?
6)  try with inspect icmp  in ASA
0
 

Author Comment

by:RickCurtis
ID: 33465597
1) We're not using NAT
2) From the ASA console I *can* ping a server in the main net
3) I can ping the inside interface from the 2008 box
4) Yes
5) Given in original info...a separate router...not the ASA
6) How do you do this?
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33465780
from the router can you ping the ASA ip ?
did u try from the router to reach other nework ?

did u add the command no nat-control ? by default asa is in no nat mode


policy-map global_policy
class inspection_default
inspect icmp
0
 

Author Closing Comment

by:RickCurtis
ID: 33467472
After re-checking, it was indeed a missing static-nat...
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question