PIX 515 no traffic on the new IP address don't block

We have received a new range of ips 213.x.x.x/28 from our ISP. They are routed through our existing entry door 92.x.x.146.

The problem:
We can not all traffic to the pix on the new 213.x.x.x/28 range.
-If we try to ping 213.x.x.61, we get the lifetime exceeded.
-ISP Gets the same thing of their router.
-ISP tries ssh and gets no route to host.

The ISP has ticked then double the Routing and the MAC address of our external interface. They are correct.

The strange thing is that we cannot see THE log messages about the new range of incoming connection attempts. The Pix is running at the level of the journal 7.

Does anyone have an idea what could be the problem? or suggestions for debugging the issue?

Excerpt from config:
7.0 (7) independent running Pix 515
outside 92.x.x.146 255.255.255.240
inside 192.168.101.1 255.255.255.0
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 92.x.x.145 1
Access-group acl_out in interface outside
acl_out list extended access permit tcp any host 213.x.x.x eq www
acl_out list extended access permit tcp any host 213.x.x.x eq ssh
static (inside, outside) 213.x.x.61 192.168.101.99 netmask 255.255.255.255
ICMP allow any inaccessible State

192.168.101.99 is a test with http and ssh linux server

Any help much appreciated.

PM

dsc_tech_1 wrote:

I have spoken to the ISP and confirmed the MAC address of the outside interface Ethernet0

ISP says
...we are sending this correctly to your pix, you should see any traffic destined for a 213.x.x.0/28 address hit your interface at 92.x.x.146/32

Yes 217.x.x.81 and 217.x.x.82 are routers owned by our ISP.

Is there anything else I can ask the ISP in terms of testing/debugging? I've run out of ideas.

If the routers are owned by your ISP, then the fault lies with them. They have a routing loop in their network and that's why packages are not your firewall. You have them shown the traceroute?

They must focus on the routeurs.81 et.82 to establish why the packets are looped between these 2 routers. Until they fix this packet will never get your firewall.

Jon

Tags: Cisco Security

Similar Questions

  • PIX 515 does not recognize the DIMM 128 MB

    PIX 515 does not recognize the DIMM 128 MB. Won't recognize only 32 MB. Also when the upgrade to 7.0, I get an error message that it has not enough flash, but I have 16 MB of flash needed.

    PIX 515 not recognizing 128 MB may be due to, in my opinion, pix-515 supports 64 MB. PIX-515e can support 128 MB. Now error Pix by reading not enough flash I got the same message when I tried to load 7.0 release using the tftp with padding interface configured to the local network with an attached TFTP server segment. I then tried the interruption during the startup control method, once the PIX reached ROMMON > issue 'auto of e1 interface', 'address 10.0.0.1', server 10.0.0.2, there are a few other commands. You may be familiar with them, otherwise use find under cisco.

    HTH

  • Add a new contact, the new email address is not alphabetical order.

    list of Windows mail contacts

    Add a new contact, the new email address is not alphabetical order

    Hello Marcococozza

    Follow responses of Dave, David and Suzanne in the link below and let me know if it helps.
  • I changed my internet provider and so I have the new email address. How can I delete my old e-mail address and put them in a new in Outlook express?

    I changed my internet provider and so I have the new email address.  How can I delete my old e-mail address and put them in a new in Outlook express? AND another problem, if I want to send pictures by e-mail... default .it my no more used by email, not allowing to send because I do not agree with them. Thank you

    original title: outlook express

    XP was the last version of Windows to use Outlook Express and that you are in a forum of Vista. Assuming that Windows Mail:
     
    Tools | Accounts and add the new address/provider and remove the old.
     
    Once the old account is removed, your second issue must be without object.
  • Error during the download of Windows 8 on Windows 7: "download failed. The download task has not completed. The new attempt at repair by block limit has been exceeded. The file is corrupted. »

    Currently, I have Windows 7 and had to buy Windows 8 for the school. I tried downloading it several times, but when she writes the check, it is said, "Download unsuccessful. The download task has not completed. The new attempt at repair by block limit has been exceeded. The file is corrupted. »

    I don't know what to do.

    Original title: download Windows 8 Windows 7

    Hello Travis,

    Thanks for posting your question on the Forums of community of Microsoft.

    To better understand the issue please help us with these questions.

    from which site you try to download Windows 8?

    b. what browser do you use to download?

    c. you try to download a full version or update?

    d. you run the upgrade wizard before trying to download the Windows 8?

    This problem usually occurs due to the installation of Web the contents of the folder in the system. So, now, I you suggest to rename or delete the installation folder to the following location and then try to download Windows 8:

    C:\Users\\AppData\Local\Microsoft\Web install

    See also the link mentioned to follow the correct steps before and during the installation of Windows 8 below:
    How to upgrade to Windows 8

    Note: I strongly recommend to back up all your important files and folders on an external storage device before performing any type of upgrade of the OS.

    Hope this information is useful. If the problem still persists, please post back for further assistance, we will be happy to help you.

  • How can I get sent emails from the old to the new email address?

    I'm moving and will have a new email address (internet society)

    How can I get my emails FORWARDED from my old to my new e-mail address e-mail address?

    You ask what their transfer of your former e-mail provider options. Once you stop the e-mail with your former provider service, you usually don't have that email address more unless you work something with them.
    Thunderbird is an email client software that runs on your computer. It has nothing to do with staging by email around the Internet. Especially e-mail addresses that no longer exist.

  • I've added another email from my computer address, but firefox did not import bookmarks for the new email address

    I have firefox as my default browser (formerly, it was internet Explorer), and I use a total access earthlink as my sign-in home page and e-mail. I've added my wife profile to this computer, and during this procedure, bookmarks for their account are also imported. But when connect us with access, home page appears correctly for his profile of earthlink but firefox bookmarks continue to flow upward with my favorites and the toolbar instead of Siena. I don't understand why firefox is not recognizing the new profile with the correct bookmarks.

    Oops, I skipped something. To copy the Favorites of your wife of the PC to the laptop, you can use the export function.

    (1) export bookmarks in Firefox on the PC: Firefox bookmarks export to a HTML file for backup or transfer bookmarks

    (2) copy this file to the laptop (for example, USB flash drive, by e-mail, or however is convenient)

    (3) import file HTML code in Firefox on the laptop: import bookmarks to an HTML file

    Please note: in the knowledge base, you will also see references to a backup/restore process. Do not use backup/restore to combine different sets of bookmarks as it does a thorough cleaning before restoring. Only use import/export to combine bookmarks.

  • Lost my domain name and cannot use the old e-mail address to pass to the new email address,... help

    my email address was on a domain that has been taken over by another person / company.
    As a result, my email does not work and I can't receive emails about this address any longer. All emails do not reach the cross. How can I change my email address on my account in Mozilla?
    Should I create a new account to Mozilla, and if so I lose all the data on my existing account?

    Specifically, "representing Mozilla?

    As a general rule, your email address is used as your username for most, if not all of the subdomains of the Mozilla, so you'll need to create a new account for each subdomain that you are registered with who uses this old email address.

    Now, if you are referring to an account of Firefox used for the synchronization service, untie all your devices that use Sync and create a new account in Firefox. Then "link" all of your devices to this new account, Firefox, using synchronization of the configuration on each device. You should not lose your data because when you reconnect to the synchronization using the new Firefox account, your data will be synchronized your different devices on the server synchronization across again.

    What is Firefox accounts?

  • Once I have opened/used a url in a new tab, I can't clesr the address bar to enter the new URL - address bar seems frozen

    whenever I open several tabs, I can't clear the address bar to enter a new URL address... I'm using the latest beta version of FF

    Start Firefox in Firefox to solve the issues in Safe Mode to check if one of the extensions or if hardware acceleration is the cause of the problem (switch to the DEFAULT theme: Firefox (Tools) > Add-ons > appearance/themes).

    It works if you open a new window?

    See also:

  • Microsoft does not send email confimation of vΘrification to the new email address

    My email address has changed today and I can't connect to Windows Live Messenger with it. I get a dialog box saying that a verification email was sent to the new address, but it does not? I had to create a new ID to open Windows Live Messenger. I will never receive this email or are my efforts in this case, just a waste of time.

    He could have in the spam (unlikely but might as well check), MS servers may be busy, or it may have been a mistake and that it has not been sent, so try getting it to be sent again.

  • cannot ping the new ip address

    Hello, everyone

    I'm working with switch SG300-10. I am trying to assign an ip address for a new VLAN ID. But I can not ping after finishing.

    First, I added a new ID (100) of VLAN

    Then I assigned a port to this vlan

    Finally, I added an ip address for this id vlan

    After that, I tried to ping 192.168.10.24, but it did not work.

    Is there something wrong, that I did?

    Hi Jiahing, you give too many omissions. All about the VLAN, IP addresses, gateways, physical connection and firewalls of material.

    It is the configuration of all for basic connectivity.

    Host A connects to port 1 in VLAN 1.

    Host A IP address is 192.168.1.10, mask 255.255.255.0 Gateway 192.168.1.254

    Host B connects to port 2 VLAN 200

    Address IP of B the host will be 192.168.2.10 with mask 255.255.255.0 Gateway 192.168.2.254

    The configuration of the switch would be as follows

    config t

    database of VLAN

    VLAN 200

    int vlan 1

    192.168.1.254/24 IP address

    int vlan 200

    192.168.2.254/24 IP address

    int gi0/2

    switchport trunk vlan 200 native

    -Tom
    Please mark replied messages useful

  • Convert the 'new' MSN address book to import in Thunderbird

    As far as I know, the new MSN mail/explore has is no longer an export option. The only thing you can do is print the list and I did it in a PDF file, but first of all lost a LOT of printer paper. As near as I can tell, the file format is a bit difficult convert one CSV file, other than by hand, which would take a lot of time. I started to do on Excel, but it would take a very long time. So, I would even be willing to pay for a service/program that would be capable of generating a CSV file in format of Thunderbird. I'd appreciate any help or ideas. Please note that MSN has changed; everything what you google or Thunderbird until help, won't work because there is no longer an export feature. I would love to know that I missed something! Sheila

    Try this: go to the MSN home page, click the icon of Outlook.com in the top left to connect to your (msn, hotmail, outlook, live) e-mail, go to the Inbox, click on the application icon next to Outlook.com icon at the top on the left, click on people, click Manage / 'Export for Outlook.com and other services', save the OutlookContacts.csv file.

    To prepare the csv file to import into TB, see this post. You want to organize the csv columns to better match the layout of the TB address book.

  • How to maintain the availability of the data store after the upgrade to ESXi 5.1 with the new IP address and the naming convention?

    How can we maintain access to the presented LUNS and VMFS data store after we improve the ESX in ESXi with the new naming convention and the new model of IP addressing?

    My back-end SAN EMC Clariion is VNX

    Thanks in advance.

    How are the hosts connected to storage systems. With FC HBA for example, there is basically nothing you need to do since the WWN will remain the same and so LUN presentation of the zoning on the switch and storage system does not need to be reconfigured.

    André

  • Firefox loses Internet every 5-10 minutes (as for example, Skype does not work), and the only way to solve this is to reset the network adapter (reset DNS and get the new IP address?)

    I click with the right button on the icon of the network adapter and press "fix." After that, I can browse sites for 5-15 minutes. But then the story repeats itself. And all of this can happen while I will have a video chat on Skype, so the internet connection is OK.

    • Try this.
    • Type in the bar of address about: config.
    • Accept the warning.
    • On the page that appears, in the filter box, type Network.http.Max - connections.
    • Replace the value 32 (which is probably the value 256 in your case).
    • Close the topic: config page.
    • Restart the browser.
  • PIX 515 (7.02) and the translation of static port

    Just try to transfer a foreign port int-> device sitting on 'inside' Interface, but do what following in the logs:

    % 106006-2-PIX: Deny UDP incoming from 66.21.215.238/50507 to client_routable_address/6881 on the interface outside

    % 106006-2-PIX: Deny UDP incoming from 62.141.54.206/6881 to client_routable_address/6881 on the interface outside

    % 106006-2-PIX: Deny UDP incoming from 84.217.31.157/6881 to client_routable_address/6881 on the interface outside

    The Config:

    access-list 101 extended permit icmp any any echo response

    access-list 101 extended permit icmp any any source-quench

    access-list 101 extended allow all unreachable icmp

    access-list 101 extended permit icmp any one time exceed

    access-list 101 extended permit tcp any host client_routable_address eq 6881

    access-list 101 extended permit udp any host client_routable_address eq 6881

    Global (outside) 3 client_routable_address

    NAT (BCM) 3 0.0.0.0 0.0.0.0

    static (BCM, outside) 192.168.20.10 tcp 6881 6881 netmask 255.255.255.255 client_routable_address

    static (BCM, outside) udp 192.168.20.10 6881 6881 netmask 255.255.255.255 client_routable_address

    Access-group 101 in external interface

    Static translations are there at the "show xlate:

    # sh xlate

    50 in use, most used 957

    Client_routable_address (6881) Local 192.168.20.10 (6881) Global PAT

    Client_routable_address (6881) Local 192.168.20.10 (6881) Global PAT

    ACL 101 "6881" entries are not to get hit if:

    # See the access list 101

    access list 101; 7 elements

    allowed for line 101 1 extended icmp access list any entire echo response (hitcnt = 0)

    line of the access list 101 permit extended 2 icmp any any source-quench (hitcnt = 10)

    extended all licences for line 101 3 access list all unreachable icmp (hitcnt = 10279)

    line 4 extended access list 101 allow icmp all a time exceeded (hitcnt = 265)

    allowed for line of the access list 101 5 scope tcp any host client_routable_address eq 6881 (hitcnt = 0)

    allowed for line in the list of 101 6 extended access udp any host client_routable_address eq 6881 (hitcnt = 0)

    Am I missing something obvious?

    Hello

    I think you've got your STATIC reversed lines, they must be:

    static (BCM, external) client_routable_address tcp 6881 192.168.20.10 6881 netmask 255.255.255.255

    Assuming that 'client_routable_address' is your public IP and the BMC is your 'inside' or the 'DMZ' interface

    Salem.

Maybe you are looking for