icmp-ip in no-nat access-list on pix6.3

Nov 02, 2006 4 Replies
M

hi,



i need to ping host 10.122.34.7 (on inside) from 192.168.193.122 (on aps-lan)



here my nat:



nat (inside) 0 access-list no-nat nat (inside) 1 10.122.32.0 255.255.255.0 64000 0 nat (inside) 1 10.122.34.0 255.255.255.0 0 0 nat (aps-lan) 2 192.168.193.0 255.255.255.0 0 0


I add following entry in the no-nat access-list:



access-list no-nat permit icmp host 10.122.34.7 host 192.168.193.122 the ping fails: [/u00/home/m] ping 10.122.34.7 no answer from 10.122.34.7



with pix logg:



305005: No translation group found for icmp src aps-lan:192.168.193.122 dst inside:10.122.34.7 (type 8, code 0) and there is no hitcount: access-list no-nat line 50 permit icmp host 10.122.34.7 host 192.168.193.122 (hitcnt=0)



now I add : access-list no-nat permit ip host 10.122.34.7 host 192.168.193.122 and ping goes through



[/u00/home/m] ping 10.122.34.7
10.122.34.7 is alive

and I get a hitcount: access-list no-nat line 52 permit ip host 10.122.34.7 host 192.168.193.122 (hitcnt=2)



why is this? I don't want to permit all IP traffic.



thanks, M


Vote
Twitter Facebook LinkedIn
B

No-nat lists need to use IP, they cannot use protocol. You should be using an acl on your aps-lan interface to filter what needs to be filtered.

-Brian

Vote
Twitter Facebook LinkedIn
M

interesting...

so this config is all wrong, they do this:

access-list aps-lan-in line 1 permit ip any any (hitcnt=670491) access-list aps-lan-in line 2 permit icmp any any (hitcnt=0)

and then "filter" individual hosts/subnets with no-nat.

I assume this is not recommended.

(btw, why no icmp hitcount? I just successfully pinged an outside host, meaning it was nat'ed)

M
Vote
Twitter Facebook LinkedIn
B

You should build the nonats subnet to subnet unless it's a very static environment with no changes or unless there is only a few hosts.

You should definatley be looking in to that IP any any...why have a firewall at all with a rule like that? It should be filtered to the host and port level what they can access.

the ip any any covers the icmp

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required