1. Home
  2. Networking Firewalls
  3. PIX Inside Command - NEED HELP!

PIX Inside Command - NEED HELP!

Hi,

I have a PIX 501 Firewall that has two interfaces - outside and inside. The Outside is connected to the Internet Router and the inside is connected to the 192.168.3.0/24 network. I also have another Router on the 192.168.3.0/24 LAN which connected to 192.168.0.0/24 via a Leased Line. The clients on 192.168.3.0/24 network have a default gateway of

192.168.3.1 (PIX Firewall).

I have added a route statement:

route inside 192.168.0.0 255.255.255.0 192.168.3.2

and made sure NAT0 is set to exclude 192.168.3.0/24 from being NATed to

192.168.0.0/24.

From a client machine i can ping 192.168.3.1 and 192.168.3.2 and can

get to the internet fine. But if i ping 192.168.0.10 or anything on

192.168.0.1 I get no reply. I have enabled debug icmp trace on the pix and can see the ICMP echo request coming into the pix for source 192.168.3.12 and destination of 192.168.0.1. I have also enabled debug ip icmp on the router but I see no ICMP requests from anything. If i change the Default gateway to the router I can ping 192.168.0.0/24 fine???

Does routing like this not work on the PIX?

Please help!

Reply to
ryanfinnerty
Loading thread data ...

In article , wrote: [PIX 501]

No, there is no way to do that on a PIX 501 without adding additional hardware.

PIX 6.x is designed so that a packet that comes in to a [logical] interface will *never* be sent back out the same [logical] interface. PIX 7.0 and PIX 7.1 are designed the same way, but those allow an exception if one of the traffic directions involves a VPN. And PIX 7 does not run on the PIX 501.

You should reconfigure your clients to add a route to 192.168.0.0 via 192.168.3.2 as well as the default route (0.0.0.0 0.0.0.0) via the PIX.

There are work-around configurations that apply in some circumstances for all -other- PIX 5xx models running PIX 6.3 or later (PIX 6.3(2) for the 506), but none of those work-arounds are possible on the PIX 501. I have described the work-arounds several times on comp.dcom.sys.cisco .

Reply to
Walter Roberson

Sorry to be a pain but could you give me links to the relevent posts regarding workarounds?

Many Thanks for your help!

Reply to
ryanfinnerty

The short summary:

a) add hardware, e.g. a router or another PIX or a Cisco ASA 5500

b) add physical interfaces to your PIX, and subnet IP space if need be

c) use an 802.1Q VLAN aware switch and a PIX that supports 802.1Q VLANs (i.e., any PIX 5xx with sufficiently new software except the 501 or 510), and subnet your IP space if need be

d) use PIX 7.x software and have one of the links be within a VPN and use the magic command to enable this case; at present this requires a PIX 515, 515E, 525, or 535.

But you can't add physical interfaces to a PIX 501, and the PIX 501 does not support VLANs and does not support 7.x software, so your only option is to change PIXes or to add another device.

Reply to
Walter Roberson

Thanks for your responses! Been a learning curve.

Reply to
ryanfinnerty

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.