Re: ICMP not keeping states? (PIX 6.3.3)
From: Wilykiote (ye_at_hright.com)
Date: 4 Oct 2004 15:16:58 -0500
wrote in news:email@example.com:
> Good evening,
> I am deploying a PIX 506. The external IP address is the internet, the
> inside network is from the private ip scope.
> The inside network has to be nated behing the external IP of the
> gateway. This works fine.
> I've got two access-lists applied on the appliance. On the inside
> interface, I've got rules specifying what kind of services the inside
> can reach. On the external interface, nothing.
> Users from the inside network need to be able to ping the outside world.
> But, the line in the acl applied on the inside interface allowss icmp
> any_any... and it does not work!
> What do I have to add to the PIX (6.3.3) to make sure the inside users
> can ping the outside world?
> Many many thanks,
Sounds like a config quirk created in teh PDM itself. You need to telnet or
console into it and check the running config. You may want to look for a
icmp deny any echo-reply inside
If you are not comfortable using the CLI fomr a console, Go to File>Show
running Config in New window and look for that entry.
IF it is there, you can go to the CLI screen in the PDM or via consol and
no icmp deny any echo-reply inside
then type in :
icmp allow any echo-reply inside
then try typing in :
This is merely a specualtion without seeing the config file itself