Pix 515-No ping from DMZ

[Nuna3]

I've enabled ping with the following access-lists:

access-list acl_out permit icmp any any
access-list acl_dmz permit icmp any any

I've bound these access lists to the outside and dmz interfaces with the following access-groups:

access-group acl_out in interface outside
access-group acl_dmz in interface dmz

Despite this, i cannot ping inside from the dmz. Any thoughts?

Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.

 

[NetworkGhost]

You will need some sort of nat enabled whether it is static, nat or "no nat". Post your config.

Free Firewall/Network/Systems Support-

http://firewalls.ath.cx

 

[Nuna3]

Here's the config; thanks for the help!


:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password cMdDMJ3V4e7ljwK/ encrypted
passwd O53TYzRjGxGspzRe encrypted
hostname pix
domain-name pix3.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol ftp 2900
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol http 2900
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sqlnet 3306
fixup protocol tftp 69
names
name 192.168.0.3 gisserver
name 192.168.0.24 server2
access-list acl_out permit tcp any host 209.28.152.235 eq www
access-list acl_out permit tcp any host 209.28.152.236 eq www
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 209.28.152.235 eq https
access-list acl_out permit tcp any any eq domain
access-list acl_dmz permit tcp any host gisserver eq https
access-list acl_dmz permit tcp any host server2 eq https
access-list acl_dmz permit tcp any host server2 eq www
access-list acl_dmz permit tcp any host gisserver eq www
access-list acl_dmz permit tcp any host gisserver eq 3306
access-list acl_dmz permit icmp any any
access-list acl_dmz permit tcp any any eq domain
access-list acl_dmz permit tcp host gisserver host 10.10.2.2 eq 3306
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.28.152.234 255.255.255.248
ip address inside 10.10.2.1 255.255.255.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
static (dmz,outside) 209.28.152.235 gisserver netmask 255.255.255.255 0 0
static (dmz,outside) 209.28.152.236 server2 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 209.28.152.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 60
dhcpd address 10.10.2.10-10.10.2.199 inside
dhcpd address 192.168.0.50-192.168.0.199 dmz
dhcpd dns 142.177.1.2 142.177.129.11
dhcpd lease 344000
dhcpd ping_timeout 750
dhcpd domain pix3
dhcpd enable inside
terminal width 510
Cryptochecksum:06e1c2850421300980f29f9b0823bd9d
: end



Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.

 

[NetworkGhost]

Try this:

static (inside,dmz) 10.10.2.0 10.10.2.0 netmask 255.255.255.0

Free Firewall/Network/Systems Support-

http://firewalls.ath.cx

 

[Nuna3]

It worked perfectly, NetworkGhost! Thanks ever so much!

Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.

 

[Nuna3]

I kinda' thought that once I had the ping fixed, it would also create connectivity for the other thing I need: I need port 3306 on 192.168.0.3 (dmz) to talk to port 3306 on 10.10.2.2 (inside). This didn't miraculously happen at the same time, much to my consternation...You're 100% on the fixes with me; care to try again?

Lowell Barkman. MCSE,A+. Network Administrator for the Nunatsiavut Government.