Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I cannot ping an Internal system to a DMZ system. I have checked the policy map session and everything time I do a ping the match shows the first ping was matched but none of the other pings were seen. Wireshark shows that there is no echo reply. Also when I am on the router, from the internal interface, I can ping the DZM gateway, but I cannot ping a DMZ host. This leads me to think I have some sort of routing problem, but for the life of me I cannot see it. The configuration looks like:


class-map type inspect match-any CLASS-INTERNET-DMZ

match protocol icmp

match protocol udp

match protocol tcp

class-map type inspect match-any CLASS-INTERNAL-DMZ

match protocol icmp

match protocol udp

match protocol tcp

class-map match-any CLASS_COX_OUT

match any

class-map type inspect match-any INTERNET-CLASS

match protocol icmp

match protocol udp

match protocol tcp

!

!

policy-map POLICY_COX_OUT

class CLASS_COX_OUT

policy-map type inspect INTERNET-POLICY

class type inspect INTERNET-CLASS

inspect

class class-default

drop

policy-map type inspect POLICY-INTERNET-DMZ

class type inspect CLASS-INTERNET-DMZ

inspect

class class-default

drop

policy-map type inspect POLICY-INTERNAL-DMZ

class type inspect CLASS-INTERNAL-DMZ

inspect

!

zone security INTERNAL

description Firewall Zone for Internal Users

zone security DMZ

description Firewall Zone for DMZ Systems

zone security GUEST

description Firewall Zone for Guest Wireless Users

zone security INTERNET

description Firewall Zone for ISP

zone-pair security INTERNAL-INTERNET source INTERNAL destination INTERNET

service-policy type inspect INTERNET-POLICY

zone-pair security DMZ-INTERNET source DMZ destination INTERNET

service-policy type inspect INTERNET-POLICY

zone-pair security GUEST-INTERNET source GUEST destination INTERNET

service-policy type inspect INTERNET-POLICY

zone-pair security INTERNAL-DMZ source INTERNAL destination DMZ

service-policy type inspect POLICY-INTERNAL-DMZ

zone-pair security INTERNET-DMZ source INTERNET destination DMZ

service-policy type inspect POLICY-INTERNET-DMZ

!

!

!

!

!

!

!

interface FastEthernet0

switchport access vlan 10

no ip address

!

interface FastEthernet1

switchport access vlan 20

no ip address

!

interface FastEthernet2

no ip address

shutdown

!

interface FastEthernet3

no ip address

shutdown

!

interface FastEthernet4

description Cox ISP Interface for all data

ip address dhcp

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat outside

ip virtual-reassembly in

zone-member security INTERNET

duplex auto

speed auto

no cdp enable

service-policy output POLICY_COX_OUT

!

interface wlan-ap0

description Service module interface to manage the embedded AP

ip unnumbered Vlan30

ip flow ingress

arp timeout 0

!

interface Wlan-GigabitEthernet0

description Internal switch interface connecting to the embedded AP

switchport mode trunk

no ip address

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$

ip address 10.42.0.1 255.255.255.0

no ip redirects

no ip unreachables

no ip proxy-arp

ip flow ingress

ip nat inside

ip virtual-reassembly in

ip tcp adjust-mss 1452

!

interface Vlan10

description Internal Users Network Vlan

ip address 192.168.42.254 255.255.255.0

ip nat inside

ip virtual-reassembly in

zone-member security INTERNAL

!

interface Vlan20

description DMZ Network Vlan

ip address 10.0.42.254 255.255.255.0

ip nat inside

ip virtual-reassembly in

zone-member security DMZ

!

interface Vlan30

description Guest Wireless Network Vlan

ip address 172.16.42.254 255.255.255.0

ip nat inside

ip virtual-reassembly in

zone-member security GUEST

!

ip forward-protocol nd

ip http server

ip http access-class 23

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip nat inside source route-map COX_NAT interface FastEthernet4 overload

ip route 0.0.0.0 0.0.0.0 dhcp

!

access-list 23 permit 10.42.0.0

access-list 110 permit ip 192.168.42.0 0.0.0.255 any

access-list 110 permit ip 172.16.42.0 0.0.0.255 any

access-list 110 permit ip 10.0.42.0 0.0.0.255 any

access-list 110 permit ip 10.42.0.0 0.0.0.255 any

access-list 110 deny ip any any

no cdp run

!

!

!

!

route-map COX_NAT permit 10

match ip address 110

match interface FastEthernet4

I am at a complete loss of what I am doing wrong.

Thank You,

David

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.