Newsgroup: it.comp.reti.cisco
Titolo: grattacapo su un pix: perchè non attraverso le interfacce?

Sto impazzendo su un PIX di cui vi incollo lo show ver:
Cisco PIX Firewall Version 6.3(1)
Cisco PIX Device Manager Version 3.0(1)
Compiled on Wed 19-Mar-03 11:49 by morlee
pix501 up 1 hour 9 mins
Hardware:   PIX-501, 16 MB RAM, CPU Am5x86 133 MHz
Flash E28F640J3 @ 0x3000000, 8MB
BIOS Flash E28F640J3 @ 0xfffd8000, 128KB
0: ethernet0: address is 000d.bc71.5ade, irq 9
1: ethernet1: address is 000d.bc71.5adf, irq 10
Licensed Features:
Failover:           Disabled
VPN-DES:            Enabled
VPN-3DES-AES:       Enabled
Maximum Interfaces: 2
Cut-through Proxy:  Enabled
Guards:             Enabled
URL-filtering:      Enabled
Inside Hosts:       10
Throughput:         Unlimited
IKE peers:          10
This PIX has a Restricted (R) license.
Serial Number: 807365119 (0x301f69ff)
Running Activation Key: 0xf396a6a4 0x884a4063 0x943afe9b 0x409546ae
Configuration last modified by enable_15 at 14:43:03.921 UTC Tue Dec 5
2006
il problema:
semplicemente non attraverso le interfacce. vi spiego meglio con un
esempio
pix501(config)# show route
        outside 0.0.0.0 0.0.0.0 192.168.0.1 1 OTHER static
        outside 192.168.0.0 255.255.255.0 192.168.0.121 1 CONNECT
static
        inside 192.168.111.0 255.255.255.0 192.168.111.1 1 CONNECT
static
il ping da un'host nella rete 192.168.111.x verso un'host della rete
192.168.0.x viene fermato dall'interfaccia inside, e viceversa nel
senso opposto dall'interfaccia outside. sembra come se il firewall non
voglia fare routing diretto tra le interfacce.
ho letto di tutto e cercato di tutto, ma non trovo l'errore.
vi incollo lo sh runn
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *** encrypted
passwd *** encrypted
hostname PIX501
domain-name provadmn
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside 192.168.0.121 255.255.255.0
ip address inside 192.168.111.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.111.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.111.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.111.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 60
terminal width 80
banner login
banner login ----> only autorized users <----
banner login
Cryptochecksum:0e6badefc96cb990752a9ff598c8eec3
: end
dove ho "stupidato" ? :)

 
Sinceramente non lo so ma prova ad abilitare il debug e vedi cosa ti dice; è la cosa più semplice e forse scopri cose 
che non pensavi che il PIX facesse.
Ciao Alex

voglia fare routing diretto tra le interfacce.
ad esempio:
access-list out2in permit tcp interface outside host 192.168.0.hostA
eq icmp
..e cmq non ci credo che hai letto di tutto! ;)

 
butto li'
access-list acl_in permit icmp any any
access-list acl_in permit tcp any any
access-list acl_in permit udp any any
access-list acl_out permit icmp any any
access-group acl_out in interface outside
access-group acl_in in interface inside
??
try
mp

 access-group acl_in in interface inside
niente, purtroppo niente di niente.
ho attivato il debug,
debug access-list all
debug route
niente, non ho messaggi. allora ho attivato
debug packet outside proto icmp
debug packet inside proto icmp
il pacchetto dunque arriva all'interfaccia (eccerto, il ping alla
inside mi risponde)
--------- PACKET ----------- IP --
192.168.222.2   ==>     192.168.0.121 (praticamente dal pc alla
outside, passando ovviamente per la 192.168.222.1 che è la inside)
        ver = 0x4       hlen = 0x5      tos = 0x0       tlen = 0x3c
        id = 0xb76      flags = 0x0     frag off=0x0
        ttl = 0x80      proto=0x1       chksum = 0xcf7e
        -- ICMP --
                type = 0x8      code = 0x0      checksum=0x9751
                identifier = 0x200      seq = 0xb40a
        -- DATA --
                00000010:                                     61 62 63
64  |
          abcd
                00000020: 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73
74  |  ef
ghijklmnopqrst
                00000030: 75 76 77 61 62 63 64 65 66 67 68 69 6d
   |  uv
wabcdefghim
--------- END OF PACKET ---------
giusto per dirne una:
pix501(config)# ping inside 192.168.0.121
(dalla inside all'ouside)
        192.168.0.121 NO response received -- 1000ms
        192.168.0.121 NO response received -- 1000ms
        192.168.0.121 NO response received -- 1000ms
pix501(config)# ping outside 192.168.222.1
(viceversa)
        192.168.222.1 NO response received -- 1000ms
        192.168.222.1 NO response received -- 1000ms
        192.168.222.1 NO response received -- 1000ms
argh!!