Re: no ping reply

Hi Imran,

Check to which interface your access-lists are mapped if you are using an
ACL to allow the icmp ping with "show access-group", however you need to
control  the icmp traffic with "debug icmp trace" and make sure that the
following rules are applied:

Access from high security level to low security level needs only an
access-list.
Access from low security level to a high security level needs a NAT
translation (static) + ACL.

Do not forget to control the routing as well " show route".

Regards,
Jalal



On 2/24/06, Albert Tuulas <albert@cubio.fi> wrote:
> Do you have NAT rules configured? Seems to be NAT misconfigured.
>
> Albert
>
> What does 'show log' and 'debug icmp trace' give when you ping inside
> 192.168.1.1 from 192.168.1.2?
>
> Albert
>
> > I have cisco pix 501 firewall the ip of outside  interface is
> > 192.168.0.9 and inside interface is 192.168.1.1. i have opened icmp
> > on outside and inside interfaces. Now when i ping 192.168.1.1 from a
> > client  having ip 192.168.1.2 no ping reply com how ever if i ping
> > the router attached  to the outside interface replys come. where is
> > the problem?
>
> >
>
> > the securiting level of outside is 0 and inside is  100
>
> >
>
> > regards,
>
> > imran imtiaz