Solved

Cannot Ping across ASA 5510 from Server 2008 - FIREWALL IS OFF

Posted on 2010-08-18
4
669 Views
Last Modified: 2012-08-14
I've got a strange one...

I have what can be described as a DMZ that is seperated from our main network by a Cisco ASA 5510.  Now, here's one strange item...this DMZ area is the *inside* and more secure.  Main network is the outside interface.  Inside has security of 100, outside=0.  

I have several Server 2003 machines in this DMZ.  I have the proper firewall rules to allow pings to and from both directions and this works as desired with all the 2003 boxes.  I've added my first Server 2008 box into this segment, compatible IP address.  It can see/ping all servers within the DMZ...but cannot ping across the ASA to anything in our main network as the 2003 boxes can.

The gateway for this segment is NOT via the ASA.  There is a router that provides the gateway.  Keep in mind...static routes are already in place for our main network through the ASA...and this works fine for all the 2003 boxes.  I've simply added a new IP address into the mix.  It doesn't work and the only glaring difference is that this is a Server 2008 box!

Before you ask... the Windows Firewall is OFF and the service is stopped on the 2008 box.
IPv6 is disabled.

Due to PCI requirements, I cannot post an ASA config here...sorry.  All I'm after is a pointer in the right direction as to why a Server 2008 box might behave differently from a 2003 box.  Of course, if there's something else that might cause this, I'm all ears!  Any ideas?
0
Comment
Question by:RickCurtis
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
anoopkmr earned 500 total points
ID: 33465514
with out seeing the firewall and the router config ? hmmm

1) did u add the proper nat commands on  asa ?
2) can u try the from the router to check the connectivity ?
3) from the inside segment , can you able to reach the firewall inside ip ?
4) from the DMZ can u reach the router IP ? ( gateway )
5) inside lan what is the gateway configired ?
6)  try with inspect icmp  in ASA
0
 

Author Comment

by:RickCurtis
ID: 33465597
1) We're not using NAT
2) From the ASA console I *can* ping a server in the main net
3) I can ping the inside interface from the 2008 box
4) Yes
5) Given in original info...a separate router...not the ASA
6) How do you do this?
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33465780
from the router can you ping the ASA ip ?
did u try from the router to reach other nework ?

did u add the command no nat-control ? by default asa is in no nat mode


policy-map global_policy
class inspection_default
inspect icmp
0
 

Author Closing Comment

by:RickCurtis
ID: 33467472
After re-checking, it was indeed a missing static-nat...
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
A procedure for exporting installed hotfix details of remote computers using powershell
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now