2 pix's on the same subnet

[optize]

I have two different PIX firewalls (two completely different networks) on the same /27.

From pix 1, I can't ping anything on pix 2
From pix 2, I can't ping anything on pix 1.

I can however ping my default gateway, I can ping the other pix, I can ping everything else except the static mappings behind that pix.

It's very strange. It will ping once and then die. It will continue to do that if I continue to clear arp. Ping once, die, clear arp, ping once, die. Etc.

I don't have any IP conflicts. My only guess is the pix is seeing traffic from it's own subnet coming into the pix and rejects it.

If you have any ideas, please help!

Thanks.

 

[rudeboy]

At a quick glance, it sounds like a subnetting issue. Please verify correct subnets and masks on both PIXes and all machines. Could you supply an example of the ip address and subnet mask of one machine on each LAN and both PIXes?

 

[optize]

It's very weird.

I found out I can ping .80, .81, and .82 of that block but nothing else. If I ping anything lower, I get the following:

[14:43] optize: 38: arp-in: response at outside from 216.207.124.67 000c.8543.6035 for x.x.124.83 000a.f4d5.f5b2
39: arp-set: added arp outside x.x.124.67 000c.8543.6035
40: arp-send: sending all saved block to outside 216.207.124.67
41: arp-in: response at outside from x.x.124.67 000f.f7f3.fbc0 for x.x.124.83 000a.f4d5.f5b2
42: arp-in: collision response received at outside from x.x.124.67/000f.f7f3.fbc0 for x.x.124.83 000a.f4d5.f5b2

When I ping .81, I get the ARP of

outside x.x.124.81 000c.8543.6035

That's the correct mac address, I don't know where it's getting that other mac from, I checked the routers and it doesn't exist.

Subnets are the same.

 

[Supergrrover]

I am not understanding the question. Are the networks the same (10.10.10.0/24 and 10.10.10.0/24) or are they seperate? Your configs and NAT statements would help.



Brent
Systems Engineer / Consultant
CCNP

 

[rudeboy]

Could you supply the ip info including subnet mask. I am only interested in the last octet. (pix a =x.x.x.80 255.255.255.248)

 

[optize]

pix a - .33 255.255.255.224
pix b - .83 255.255.255.224

they are both 192.168.100.0/24 on the backend.

 

[rudeboy]

If you are trying to ping public IPs and that is not working, then we need to see the PIX configs. If you are trying to ping private IPs, that will pose a problem as 192.168.100.1 will never go to its gateway to ping 192.168.100.x.