Debugging a mainframe printer install on PIX 506

Trying to get a Unisys Mainframe to be able to install a printer.
The printer installs fine from the Windows 2003 side, and prints.
But I haven't a clue why it can't isntall on the MCP side.

I figured I could turn on some debugging on the Cisco 506 and see what
was going on. i can't for the life of me figure out what debug
commands to enter to watch what I assume is 'ip' traffic.
They Unisys techs are certain the print to port 9100 (lpr?)

My sh access-list shows:
access-list acl_out permit ip host MAINFR-PR1 any (hitcnt=0)
access-list acl_out permit ip host MAINFR-PR2 any (hitcnt=0)
access-list acl_out permit ip host AETHUSA host LUNA (hitcnt=0)
access-list acl_out permit ip host AETHRA host LUNA (hitcnt=42)


my configs relevant lines are:

static (inside,outside) MAINFR-PR1 MAINFR-PR1 netmask 255.255.255.255
0 0
static (inside,outside) MAINFR-PR2 MAINFR-PR2 netmask 255.255.255.255
0 0
access-list acl_out permit ip host MAINFR-PR1 any
access-list acl_out permit ip host MAINFR-PR2 any
access-list acl_out permit ip host AETHUSA host LUNA
access-list acl_out permit ip host AETHRA host LUNA

AETHRA is the windows side of the mainframe.
AETHUSA is the MCP side.
LUNA is the windows print server behind the firewall.
MAINFR-PR1 and 2 are the HP printers that print fine from the window
print server, but aren't being hit via the MCP printing directly to
their IP addresses.

I would appreciate any idea's.
What would be very useful, is a functioning debug command. The syntax
on the '?' is somewhat maddening to me. icmp is easy, but ip, just
isn't being accepted.

Bruce D. Meyer

 

Instead of doing a debug you can activate
a capture to see what traffic is going through the PIX.

I didn't completely understand what devices are on the inside
and outside of your firewall , but if you want to capture all
traffic between a device outside DEVOUT and a device inside DEVIN,
you can do the following.;

For traffic incoming or leaving the outside interface

-Create an access-list
access-list caplo permit ip host DEVOUT host DEVIN
access-list caplo permit ip host DEVIN host DEVOUT

-Activate a packet capture
capture capout access-list caplo interface outside

-check the result
sh capture capout
( clear capture capout to reset the buffer , and no capture capout when
your done)

Fot traffic incoming or leaving the inside interface

-Create an access-list
access-list capli permit ip host DEVOUT host DEVIN
access-list capli permit ip host DEVIN host DEVOUT

-Activate a packet capture
capture capin access-list capli interface inside

-check the result
sh capture capin
( clear capture capin to reset the buffer , and no capture capin when
your done)


You can run both simultaneously (preferably with different acl, even if they
are identical),
and play with your acl to pinpoint the traffic you want to monitor.