simple testing configuration access-list question

[catatung]

Hello,

I am trying to write up a configuration to test PIX firewalls. I have a pix 515 which I have networked into a hub with two other computers. I am trying to display it's ability to refuse connections. I can ping it from one machine and I can ping the machine from it.. I put in the access-list:

access-list all deny ICMP any any

but I can still ping the machine from the firewall and I can still ping the firewall from the machine. Shouldn't pings not be responded to with that rule? and If I have this wrong, what can I use to prove the firewall has the ability to refuse certain connections? I have linux redhat 9.0 on one machine and win NT server on the other.

any help would is appreciated
thanks
-Randy

 

[themut]

You need the "icmp..." command. Take a look at the link below:

http://www.cisco.com/warp/public/110/31.html#pingsown

 

[catatung]

Hey thanks I got it working....

How come that command doesn't work though? In theory, shouldn't it?

 

[themut]

Nope it should not work, the access list entry for ICMP works only for traffic passing through the PIX and not to the PIX. For ICMP traffic to the PIX´s interface you need the "icmp ..." command.

 

[catatung]

ah.. i see it now
thanks for the help!

-=Randy