Cisco PIX 525 Especificaciones descargar pdf (Pagina 516)

100

101

32-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 32 Monitoring and Troubleshooting

Troubleshooting the Security Appliance

Step 1 To add an access list allowing ICMP from any source host, enter the following command:

hostname(config)# access-list ICMPACL

extended

permit icmp any any

By default, when hosts access a lower security interface, all traffic is allowed through. However, to

access a higher security interface, you need the preceding access list.

Step 2 To assign the access list to each source interface, enter the following command:

hostname(config)# access-group ICMPACL

in interface

interface_name

Repeat this command for each source interface.

Step 3 To enable the ICMP inspection engine, so ICMP responses are allowed back to the source host, enter the

following commands:

hostname(config)# class-map ICMP-CLASS

hostname(config-cmap)# match access-list ICMPACL

hostname(config-cmap)# policy-map ICMP-POLICY

hostname(config-pmap)# class ICMP-CLASS

hostname(config-pmap-c)# inspect icmp

hostname(config-pmap-c)# service-map ICMP-POLICY global

Alternatively, you can also apply the ICMPACL access list to the destination interface to allow ICMP

traffic back through the security appliance.

Step 4 Ping from the host or router through the source interface to another host or router on another interface.

Repeat this step for as many interface pairs as you want to check.

If the ping succeeds, you see a system message confirming the address translation for routed mode

(305009 or 305011) and that an ICMP connection was established (302020). You can also enter the

show xlate and show conns commands to view this information.

If the ping fails for transparent mode, contact Cisco TAC.

For routed mode, the ping might fail because NAT is not configured correctly (see Figure 32-5). This is

more likely if you enable NAT control. In this case, you see a system message showing that the NAT

translation failed (305005 or 305006). If the ping is from an outside host to an inside host, and you do

not have a static translation (which is required with NAT control), you see message 106010: deny

inbound icmp.

Note The security appliance only shows ICMP debug messages for pings to the security appliance interfaces,

and not for pings through the security appliance to other hosts.

Figure 32-5 Ping Failure Because the Security Appliance is not Translating Addresses

Ping

Router

Host

Security

Appliance

126694

1 2 ... 511 512 513 514 515 516 517 518 519 520 521 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 516

Comentarios a estos manuales