Firewall issue 1

[Namekian]

I have a PIX515 firewall with 4 interfaces and have run into a problem. I have currently connected to a cisco 2621 router and a switch. In the firewall I can ping the router and switch, in the switch I can ping the firewall interface and the outside interface, but I can't get the hosts to communicate with the router. The host can ping the firewall, but not the interface connected to the router.

Here is my config:
interface ethernet0 auto
interface ethernet1 auto shutdown
interface ethernet2 auto
interface ethernet3 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 prinetwork security0
nameif ethernet3 secnetwork security0
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
mtu outside 1500
mtu inside 1500
mtu prinetwork 1500
mtu secnetwork 1500
ip address outside 172.16.5.130 255.255.255.192
no ip address inside
ip address prinetwork 172.16.4.131 255.255.255.192
no ip address secnetwork
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address prinetwork
no failover ip address secnetwork
pdm history enable
arp timeout 14400
rip outside passive version 1
rip outside default version 1
rip outside default version 1
rip prinetwork default version 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 172.16.4.179-172.16.4.190 prinetwork
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable prinetwork
terminal width 80
Cryptochecksum:8cd0045067a84c10f7a11d49a6d8c4c4
: end

 

[intelwizrd]

the problem is that the pix will not pass traffic between two interfaces of the same security level without additional configuration. i make it ia point not to have two interfaces with the same security level.

try the following
nameif ethernet2 prinetwork security10

this will allow traffic to flow from prinetwork to outside. you will have to set up static translations and access lists to go from outside to inside.

you should then be able to ping the router from a host on prinetwork, however, you will not be able to ping the "outside" interface ip from prinetwork. the pix wont let you ping the interface ips unless you are on that network.

----------------------------
Josh
CCNA, MCSE 2003(in progress)

 

[Namekian]

Still nothing.
Here is the new config:
interface ethernet0 auto
interface ethernet1 auto shutdown
interface ethernet2 auto
interface ethernet3 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 prinetwork security10
nameif ethernet3 servers security20
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list 1 permit ip 172.16.4.128 255.255.255.192 172.16.5.128 255.255.255.19
2
pager lines 24
mtu outside 1500
mtu inside 1500
mtu prinetwork 1500
mtu servers 1500
ip address outside 172.16.5.130 255.255.255.192
no ip address inside
ip address prinetwork 172.16.4.131 255.255.255.192
no ip address servers
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address prinetwork
no failover ip address servers
pdm history enable
arp timeout 14400
static (prinetwork,outside) 172.16.5.128 172.16.4.128 netmask 255.255.255.192 10
00 0
rip outside passive version 1
rip outside default version 1
rip prinetwork passive version 1
rip prinetwork default version 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 172.16.4.179-172.16.4.190 prinetwork
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable prinetwork
terminal width 80
Cryptochecksum:8cd0045067a84c10f7a11d49a6d8c4c4

I won't be able to ping the outside interface, but I should be able to ping the interface connected to it on the router right?

 

[intelwizrd]

connect via a console cable

conf t
debug icmp trace

then try your pings, you will be able to see them and should be able to see where they are being blocked. i have a feeling it is a problem with the nat but i can't think straight right now. post the results of the ping trace and i (or someone) can help you out. something is staring me in the face and i cant figure out what it is.

----------------------------
Josh
CCNA, MCSE 2003(in progress)

 

[Namekian]

Ok, now this is really confusing me. I know you cant ping the interface on the firewall connected to the router. But here is the results from the ping to the router off the outside interface.
Outbound ICMP echo request (len 32 id 2 seq 47104) 172.1
6.4.180 > 172.16.5.180 > 172.16.5.129
2: Inbound ICMP echo reply (len 32 id 2 seq 47104) 172.16.5.129 > 172.16.5.180
> 172.16.4.180
3: Outbound ICMP echo request (len 32 id 2 seq 47360) 172.16.4.180 > 172.16.5.18
0 > 172.16.5.129
4: Inbound ICMP echo reply (len 32 id 2 seq 47360) 172.16.5.129 > 172.16.5.180
> 172.16.4.180
5: Outbound ICMP echo request (len 32 id 2 seq 47616) 172.16.4.180 > 172.16.5.18
0 > 172.16.5.129
6: Inbound ICMP echo reply (len 32 id 2 seq 47616) 172.16.5.129 > 172.16.5.180
> 172.16.4.180
7: Outbound ICMP echo request (len 32 id 2 seq 47872) 172.16.4.180 > 172.16.5.18
0 > 172.16.5.129
8: Inbound ICMP echo reply (len 32 id 2 seq 47872) 172.16.5.129 > 172.16.5.180
> 172.16.4.180

It seems like it is getting through, but on the host machine it states request timed out. Is it connected, and I just can't ping either ports?

 

[lgarner]

You acl allows all IP outbound, which isn't needed (that's the default), but nothing inbound. ACL's also need to be applied to the receiving interface

For ping replies, try this:

access-list outside_inbound permit icmp any any eq echo-reply
access-group outside_inbound in interface outside

 

[Namekian]

I got it to work with some of those static translations, I still haven't gotten ping to work, but I can telnet so I know that it works.

Thanks for the help, this is the second time you have helped me, what Cisco lvl are you? CCNP?

 

[lgarner]

You can telnet out because that's a TCP connection, and Pix allows outbound connections, and inbound replies to them.

Ping is ICMP, so there is no relation between the outbound "echo-request" and inbound "echo-reply". Hence, the ACL is needed.

I don't know if your last question was directed to me or not. I'm a CCNA and used the Pix exam (CSPFA) to renew it last year.

 

[intelwizrd]

should have paid more attention the first time around. try this

icmp permit any outside
icmp permit any prinetwork

----------------------------
Josh
CCNA, MCSE 2003(in progress)

 

[Namekian]

Worked like a charm.

And yea that was directed at you. I have just finished the CCNA program and was wondering if you took the CCNP for the PIX stuff or one of Cisco's side classes, now I know.

Thanks for your help.