I can not ping the DMZ from hte inside.

[NetOpsTech]

I can not ping hte DMZ from the inside. Bit I can pning out to the internet.

I thought the PIX allows higher to lower security traffic to pass through.

What's wrong?

 

[themut]

The PIX handles ICMP traffic differently, you need an access list to allow the ICMP reply back in. Try adding these commands:

access-list <acl-name> permit icmp any any echo-reply
access-group <acl-name> in interface dmz

Of course <acl-name> is the name of your access list applied to the DMZ if you have one.
Take a look at this link if you want a thourough explanation:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

 

[NetOpsTech]

I have this configured for icmp
access-list DMZ permit icmp any any <- this is at het end of my DMZ acl, I have maybe 40 DMZ acl entries.

access-group DMZ in interface DMZ

 

[NetOpsTech]

My inside ip address range is 10.1.1.1-10.1.1.254
MY DMZ ip address range is 192.168.168.1-192.168.168.254

I have one static statement regarding my DMZ:
static (inside,DMZ) 10.1.1.0 10.1.1.0 netmask 255.255.255.0


Do I need to add another static statement like this ?
static (DMZ,inside)192.168.168.0 192.168.168.0 netmask 255.255.255.0, if I add this exact statment what security risks do I run?

 

[themut]

You don't need a static DMZ, inside
It should work as it is... Are there any deny statements on your ACL? If so make sure the ICMP entry precedes any deny statements. Also, make sure the machine you are trying to ping doesn't have a firewall. Try to look into syslogs to determine if the PIX is denying the traffic.

 

[NetOpsTech]

It started working again.
Very weird.