Hi all,
I am working on a lab PIX loaded with 6.2(2)
Here is the BASE configuration:
--------------------------------------------------------
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 DMZ security50
ip address outside 200.200.200.2 255.255.255.0
ip address inside 21.21.21.2 255.255.255.0
ip address DMZ 22.22.22.2 255.255.255.0
Host A on DMZ: 22.22.22.3 (g/w: DMZ IP)
Host B on inside: 21.21.21.3 (g/w: inside IP)
ACL applied:
access-list acl-dmz permit icmp any any echo
access-list acl-dmz permit icmp any any echo-reply
access-group acl-dmz in interface DMZ
--------------------------------------------------------
##############
*Condition1: (No nat0 or static command and XLATE table is empty)*
If I initiate a ping from A to B (lower to higher), I get the translation
error:
*305005: No translation group found for icmp src DMZ:22.22.22.3 dst inside:
21.21.21.3 (type 8, code 0)*
*Condition2: (nat0 for DMZ subnet)*
I add the below to BASE config:
nat (inside) 0 21.21.21.0 255.255.255.0
I still get the 305005 error.
*Condition3: (no nat0 or static command)*
I add these to BASE configs:
PIX-515(config)# nat (DMZ) 1 22.22.22.3 255.255.255.255
PIX-515(config)# global (inside) 1 22.22.22.3 255.255.255.255 (dmz to inside
translation)
Still, I get the 305005 error.
*Condition3: (no nat0, but static command for dmz host B)*
I add the following command
static (dmz,inside) 22.22.22.3 22.22.22.3 netmask 255.255.255.255 (static
NATing A)
Still, the error remains.
##############
I am able to ping B from A only under below conditions:
1. nat (inside) 0 21.21.21.0 (B's subnet) *........OR...*
**
2. static (inside,dmz) 21.21.21.3 21.21.21.3 netmask 255.255.255.255 (static
NATing B)
#############
AFAIK, an ACL on the DMZ (lower security) to allow ICMP should allow the
ping. I just confirmed it on a 525 box running 7.0.
What is going wrong in the three conditions above? Is my understanding
incorrect?
--
Warm regards,
Amol Sapkal
-------------------------------------------------------------------
"When I'm not in my right mind, my left mind
gets pretty crowded"
-------------------------------------------------------------------
