ICMP issue :: Static NAT and Dynamic PAT on PIX

Discussion in 'Cisco' started by swapnendu, Oct 30, 2006.

  1. swapnendu

    swapnendu

    Joined:
    Sep 13, 2006
    Messages:
    57
    Likes Received:
    0
    This happened by mistake....

    I did a Static NAT 172.16.1.10<=>200.X.X.X
    e.g. static (inside,outside) 200.X.X.X ,172.16.1.10

    Then the same public IP was used to do a PAT .
    nat (inside) 1 0 0
    global (outside) 200.X.X.X

    Though all the users in my inside network were able to access the internet (www, mails etc.) , expect my static host i.e 172.16.1.10 , none of the hosts were able to ping any machine on the outside network. Except ICMP almost everything was fine ( i'm using almost coz this happened in one of the production networks i was wrking on and due to the exigency, cudn't do much to figure out why and what else was not wrking )

    Any clue from anyone why this happened ..??

    though i'm myself a CCSP, i cudnt think of any obvsious reason y this wud happen ....anyway any comments/help/suggestion is welcome...

    will answer myself after some RnD if i dont get an answer on this forum for sure !!

    cheers :)
    long live Velocity reviews !!
     
    swapnendu, Oct 30, 2006
    #1

    1. Advertisements

  2. swapnendu

    srinath_7

    Joined:
    Oct 16, 2006
    Messages:
    6
    Likes Received:
    0
    PIX echo reply

    Permit icmp echo reply on the outside interface to receive replies.

    By default PIX drops ICMP packets.:shake:

     
    srinath_7, Nov 3, 2006
    #2

    1. Advertisements

  3. swapnendu

    swapnendu

    Joined:
    Sep 13, 2006
    Messages:
    57
    Likes Received:
    0
    ICMP echo reply is allowed dude, and tht is y i'm able to ping frm 172.16.1.10...its not due to ACLs but due to this combination of Static NAT and PAT using single public ip address...cudnt' get the time to replicate the scenario and do some RnD...will for for some free time :)
     
    swapnendu, Nov 4, 2006
    #3

    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads

  1. static nat and dynamic at pix 501

  2. VPN between 2 Cisco routers (1 static, 1 dynamic) with access from stat --> dynamic over ISDN

  3. PAT and Static NAT on a PIX 501

  4. Static PAT overrides Dynamic Pat - Pix 515e

  5. Pings and PIX messages 302020: Built ICMP - 302021: Teardown ICMP Lots of them....

  6. acl+Static nat+Dynamic Nat

  7. FWSM/PIX and Dynamic PAT using global IP range vs. global interface vs. global IP

  8. PIX NAT/PAT IP locks up, but static conduits continue - How to track bad pc?

Loading...