cisco pix 515 outside ping to internal hosts

This is not a good idea. Perhaps you could better monitor over a secure connection (like SSH, SSL, TLS, etc.), not with ICMP echo.

Yours, VB.

thanx for the reply. my apps needs ping, unfortunately. i do not think this will work, but i could be wrong.. so when i ping x.x.x.112 how does the pix determine which internal hosts i am pinging??

Then you'll need some VPN.

Yours, VB.

In article , wrote: :can this be done. I have cisco pix 515e and would like to ping internal :hosts for monitoring purposes. :i have no trouble pinging the outside real IP. just don't know how to :accomplish pinging the inside IP. i would like to ping my mail server :inside for monitoring purposes. i would like to restrict ping from a :certain host. the mail server inside is 192.168.100.50 :inside hosts have no problems pinging outside.

:access-list 100 permit icmp any any echo-reply :access-list 100 permit icmp any any time-exceeded :access-list 100 permit icmp any any

The third line is a superset of the first two, so the first two are not needed in that configuration. On the other hand, you don't really want to permit in all icmp, as people are actively using icmp network redirects in order to try to steal banking information .

To allow in ping specifically, I suggest

access-list 100 permit icmp any host x.x.x.112 echo

:access-group 100 in interface outside

:static (inside,outside) tcp x.x.x.112 1001 192.168.100.48 8080 netmask

In order to get the icmp through to the host, you will have to forward the entire IP, not just individual ports.

if you have PIX 6.3 then you could try using "policy static".