Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 84)

2-24

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Testing and Saving Your Configuration

To ping from one interface to another, bind the access-list and access-group command statements to the

lower security interface, which lets the ICMP echo reply to return to the sending host.

For example, enter the following command statement to ping from the inside interface to the outside

interface:

access-group acl_out in interface outside

Step 3 Enable debugging.

Enter configuration mode and start the debug icmp trace command to monitor ping results through the

PIX

Firewall. In addition, start syslog logging with the logging buffered debugging command to check

for denied connections or ping results. The debug messages display directly on the console session. You

can view syslog messages with the show logging command.

Before using the debug command, use the who command to see if there are any Telnet sessions to the

console. If the debug command finds a Telnet session, it automatically sends the debug output to the

Telnet session instead of the console. This will cause the serial console session to seem as though no

output is appearing when it is really going to the Telnet session.

Step 4 Ping around the PIX Firewall.

Ping from the PIX Firewall to a host or router on each interface. Then go to a host or router on each

interface and ping the PIX

Firewall unit’s interface. In software Version 5.3 and higher, the PIX Firewall

ping command has been improved so you do not need to specify the interface name if the host’s IP

address is on the same subnet as a PIX

Firewall interface. For the example, you would use these ping

commands from the PIX

Firewall command line to ping hosts or routers.

ping 192.168.0.2

ping 192.168.1.2

ping 192.168.2.2

ping 192.168.3.2

ping 192.168.4.2

ping 209.165.201.2

Then ping the PIX Firewall interfaces from the hosts or routers with commands such as the following:

• Ping the PIX Firewall’s outside interface with ping 209.165.201.1

• Ping the PIX Firewall’s inside interface with ping 192.168.0.1

• Ping the PIX Firewall’s dmz1 interface with ping 192.168.1.1

• Ping the PIX Firewall’s dmz2 interface with ping 192.168.2.1

• Ping the PIX Firewall’s dmz3 interface with ping 192.168.3.1

• Ping the PIX Firewall’s dmz4 interface with ping 192.168.4.1

If the pings from the hosts or routers to the PIX Firewall interfaces are not successful, check the debug

messages, which should have displayed on the console. Successful ping debug messages appear as in this

example.

ICMP echo reply (len 32 id 1 seq 256) 209.165.201.1 > 209.165.201.2

ICMP echo request (len 32 id 1 seq 512) 209.165.201.2 > 209.165.201.1

Both the request and reply statements should appear, which shows that the PIX Firewall and the host

responded. If none of these messages appeared while pinging the interfaces, then there is a routing

problem between the host or router and the PIX

Firewall that caused the ping (ICMP) packets to never

arrive at the PIX

Firewall.

1 2 ... 79 80 81 82 83 84 85 86 87 88 89 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 84

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525