Problem --

[billyz]

I posted this on the Cisco PIX forum...hopeing to find some help here.


thread35-289304 a weird one.

I have a switched network with about 125 clients. All connect to 9 3com 3300 switches. I use a PIX 515 for internet access and reporting.

One fine day, several workstations stop working (unable to access internet), they are unable to ping the default gatewway (which is the PIX), they can ping any other machine on the network, and other machines on the network can ping them (the pix cannot ping them)

wait -- it gets weirder (is weirder a word?)

the ones that dont work are all older Compaq Deskpro EN 450 wth the Intel Pro100 card. The newer compaq deskpros (the p1.3ghz) have the same card, but are fine.

WAIT !!! THERES MORE

i just purchased 5 new Deskpro Evos, and they CANNOT PING THE PIX !!!

ACK!

so what I did to figure this thing out is to manually add the MAC of one machine to the PIX's ARP cache, then it works, but i dont really see that as a good solution --

the pix's arp config is default settings, never changed.

now what???

-BillyZ

 

[salserocito]

My understanding, and this came directly from Cisco Support, is that you cannot and should not use the PIX as your default gateway. You should have another device, such as a true Router or Server with a staticly configured Default Route pointing to the PIX, act as the Default Gateway for your workstations.

I had the same issue here. In fact, somewhere in the Cisco PIX documentation, it actually does say that the PIX cannot be used as the default gateway.

As soon as I configured our Frame-Relay routers with default routes pointing to the PIX Firewalls, and made all the workstations point to the Router as their Default Gateway, everything worked like a charm!!!

Good Luck!

 

[billyz]

I remember recently reading that too...suprising.
hmmm....OK, i have a spare 2501, i'll try it out.


Thx.
-Bill

 

[billyz]

I know its been a while, but i wanted to close this out -- To fix the problem, I re-flashed the PIX (actually there was an update available, so now it works OK, all can ping all)

-BIllyZ