Newbi needs help - Pix 501 and Ping

[StaffanC]

Hi there folks!

I'm new to firewalls. Bougth a Pix 501 ( FOS 6.3(1) and PDM 3.0) an eminent book on the actual hardware. Recommended reading by this forum, actually.

I've got the firewall up and running behind my home ADSL internet connection. I can browse the web without any problems at all. But, as always, I get stuck on trivialities!

When I try to ping the office Netgear Router (OK I will replace it with the PIX in due time) the PIX won't let the ping through (I dont even know if it will let the PING out in the first place either).

I've tried (using the PDM) to enable ICMP on the inside/outside interface. I've tried to make an ACL etc.

Please, help me out here. In my opinion, the PIX should let it through since I'm initiating from the inside? I'm sure this is basics but never the less it's ruining my day!

Look forward to takeing part of your ideas.

Kind regards,

Staffan Carlsson

 

[yizhar]

HI.

> Please, help me out here. In my opinion, the PIX should let it through since I'm initiating from the inside?
You're logic is good, but the pix implementation of ICMP does not work like TCP so it is not working the same way.

What devices do you have between your PIX and the ISP?
Modem/Router? is it doing NAT also?
Can you ping the modem/router?
Can you ping your ISP DNS server?
Post the pix config (see the FAQ for guidelines).

> I've tried (using the PDM) to enable ICMP on the inside/outside interface
You should use "Access Rules", the first page in PDM, to enable ICMP **via** the pix. Enabling ICMP on the interfaces is only for pinging the pix own interfaces.

More info:

PIX Links:

http://teachers.sivan.co.il/yizhar/files/pixlinks.htm

Software Samples and Tips:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration

Handling ICMP Pings with the PIX Firewall:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[yizhar]

Note:

The last link (Handling ICMP Pings with the PIX Firewall) is an old one using the obsolute "conduit" command.
However it also includes the newer "access-list" command.

You should use access-list commands, for example:

access-list fromoutside permit icmp any any eq echo-reply
access-group fromoutside in interface outside

Bye


Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[StaffanC]

Dear Yizhar,

Many thanks for your interest and suggestions for icmp configuration. After having read some additional chapters in my Cisco Pix Firewalls book, by Richard Deal, I found a similar solution to the problem as the one you suggested in your emminent answer.

Once again, many thanks for you time and trouble.

Cheers,

Staffan Carlsson