ICMP not keeping states? (PIX 6.3.3)

From: Michael (kdo-jh7_at_iximail.com.this.is.a.real.email.address.even.if.weird)
Date: 10/04/04


Date: Mon, 04 Oct 2004 21:32:02 +0200

Good evening,

I am deploying a PIX 506. The external IP address is the internet, the
inside network is from the private ip scope.

The inside network has to be nated behing the external IP of the
gateway. This works fine.

I've got two access-lists applied on the appliance. On the inside
interface, I've got rules specifying what kind of services the inside
can reach. On the external interface, nothing.

Users from the inside network need to be able to ping the outside world.
  But, the line in the acl applied on the inside interface allowss icmp
any_any... and it does not work!

What do I have to add to the PIX (6.3.3) to make sure the inside users
can ping the outside world?

Many many thanks,

/michael



Relevant Pages

  • Re: multi-homed systems stop answering ARP on local addresses w/ifconfig aliases
    ... multi-homed systems stop answering ARP on local addresses ... hence anything on that network completely stops functioning. ... routing to a locally assigned address via another interface, ... you can't even ping the affected locally ...
    (freebsd-net)
  • Re: Implicit rule PIX
    ... >>So i have block acces from DMZ to inside first and then allow DMZ acces ... Given the above rule applied to the DMZ interface, ... the complete network is a public ip /24 network devided into ... The pix has to control who can talk to who, ...
    (comp.dcom.sys.cisco)
  • Re: Implicit rule PIX
    ... >>So i have block acces from DMZ to inside first and then allow DMZ acces ... Given the above rule applied to the DMZ interface, ... the complete network is a public ip /24 network devided into ... The pix has to control who can talk to who, ...
    (comp.dcom.sys.cisco)
  • ping using multiple interfaces
    ... I have a network on which my Solaris machine has ... I need to be able to ping other machines using the source ... that all pings are going out over the first interface. ... Is there a known issue here with Solaris sockets or with ping? ...
    (comp.unix.solaris)
  • cant connect to the network
    ... interface. ... ping any other device on the network. ... Do you Yahoo!? ...
    (freebsd-questions)