Solved

Cannot Ping across ASA 5510 from Server 2008 - FIREWALL IS OFF

Posted on 2010-08-18
4
672 Views
Last Modified: 2012-08-14
I've got a strange one...

I have what can be described as a DMZ that is seperated from our main network by a Cisco ASA 5510.  Now, here's one strange item...this DMZ area is the *inside* and more secure.  Main network is the outside interface.  Inside has security of 100, outside=0.  

I have several Server 2003 machines in this DMZ.  I have the proper firewall rules to allow pings to and from both directions and this works as desired with all the 2003 boxes.  I've added my first Server 2008 box into this segment, compatible IP address.  It can see/ping all servers within the DMZ...but cannot ping across the ASA to anything in our main network as the 2003 boxes can.

The gateway for this segment is NOT via the ASA.  There is a router that provides the gateway.  Keep in mind...static routes are already in place for our main network through the ASA...and this works fine for all the 2003 boxes.  I've simply added a new IP address into the mix.  It doesn't work and the only glaring difference is that this is a Server 2008 box!

Before you ask... the Windows Firewall is OFF and the service is stopped on the 2008 box.
IPv6 is disabled.

Due to PCI requirements, I cannot post an ASA config here...sorry.  All I'm after is a pointer in the right direction as to why a Server 2008 box might behave differently from a 2003 box.  Of course, if there's something else that might cause this, I'm all ears!  Any ideas?
0
Comment
Question by:RickCurtis
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
anoopkmr earned 500 total points
ID: 33465514
with out seeing the firewall and the router config ? hmmm

1) did u add the proper nat commands on  asa ?
2) can u try the from the router to check the connectivity ?
3) from the inside segment , can you able to reach the firewall inside ip ?
4) from the DMZ can u reach the router IP ? ( gateway )
5) inside lan what is the gateway configired ?
6)  try with inspect icmp  in ASA
0
 

Author Comment

by:RickCurtis
ID: 33465597
1) We're not using NAT
2) From the ASA console I *can* ping a server in the main net
3) I can ping the inside interface from the 2008 box
4) Yes
5) Given in original info...a separate router...not the ASA
6) How do you do this?
0
 
LVL 14

Expert Comment

by:anoopkmr
ID: 33465780
from the router can you ping the ASA ip ?
did u try from the router to reach other nework ?

did u add the command no nat-control ? by default asa is in no nat mode


policy-map global_policy
class inspection_default
inspect icmp
0
 

Author Closing Comment

by:RickCurtis
ID: 33467472
After re-checking, it was indeed a missing static-nat...
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASA Deny No Connection PSH ACK, Traffic is dropped 10 67
VIRL IP adress 3 58
The purpose of using BGP 33 72
Export all user attributes in Active Directory 2008 R2 4 44
I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now