I cannot ping an Internal system to a DMZ system. I have checked the policy map session and everything time I do a ping the match shows the first ping was matched but none of the other pings were seen. Wireshark shows that there is no echo reply. Also when I am on the router, from the internal interface, I can ping the DZM gateway, but I cannot ping a DMZ host. This leads me to think I have some sort of routing problem, but for the life of me I cannot see it. The configuration looks like:
class-map type inspect match-any CLASS-INTERNET-DMZ match protocol icmp match protocol udp match protocol tcp class-map type inspect match-any CLASS-INTERNAL-DMZ match protocol icmp match protocol udp match protocol tcp class-map match-any CLASS_COX_OUT match any class-map type inspect match-any INTERNET-CLASS match protocol icmp match protocol udp match protocol tcp ! ! policy-map POLICY_COX_OUT class CLASS_COX_OUT policy-map type inspect INTERNET-POLICY class type inspect INTERNET-CLASS inspect class class-default drop policy-map type inspect POLICY-INTERNET-DMZ class type inspect CLASS-INTERNET-DMZ inspect class class-default drop policy-map type inspect POLICY-INTERNAL-DMZ class type inspect CLASS-INTERNAL-DMZ inspect ! zone security INTERNAL description Firewall Zone for Internal Users zone security DMZ description Firewall Zone for DMZ Systems zone security GUEST description Firewall Zone for Guest Wireless Users zone security INTERNET description Firewall Zone for ISP zone-pair security INTERNAL-INTERNET source INTERNAL destination INTERNET service-policy type inspect INTERNET-POLICY zone-pair security DMZ-INTERNET source DMZ destination INTERNET service-policy type inspect INTERNET-POLICY zone-pair security GUEST-INTERNET source GUEST destination INTERNET service-policy type inspect INTERNET-POLICY zone-pair security INTERNAL-DMZ source INTERNAL destination DMZ service-policy type inspect POLICY-INTERNAL-DMZ zone-pair security INTERNET-DMZ source INTERNET destination DMZ service-policy type inspect POLICY-INTERNET-DMZ ! ! ! ! ! ! ! interface FastEthernet0 switchport access vlan 10 no ip address ! interface FastEthernet1 switchport access vlan 20 no ip address ! interface FastEthernet2 no ip address shutdown ! interface FastEthernet3 no ip address shutdown ! interface FastEthernet4 description Cox ISP Interface for all data ip address dhcp no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ip nat outside ip virtual-reassembly in zone-member security INTERNET duplex auto speed auto no cdp enable service-policy output POLICY_COX_OUT ! interface wlan-ap0 description Service module interface to manage the embedded AP ip unnumbered Vlan30 ip flow ingress arp timeout 0 ! interface Wlan-GigabitEthernet0 description Internal switch interface connecting to the embedded AP switchport mode trunk no ip address ! interface Vlan1 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$ ip address 10.42.0.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ! interface Vlan10 description Internal Users Network Vlan ip address 192.168.42.254 255.255.255.0 ip nat inside ip virtual-reassembly in zone-member security INTERNAL ! interface Vlan20 description DMZ Network Vlan ip address 10.0.42.254 255.255.255.0 ip nat inside ip virtual-reassembly in zone-member security DMZ ! interface Vlan30 description Guest Wireless Network Vlan ip address 172.16.42.254 255.255.255.0 ip nat inside ip virtual-reassembly in zone-member security GUEST ! ip forward-protocol nd ip http server ip http access-class 23 ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip nat inside source route-map COX_NAT interface FastEthernet4 overload ip route 0.0.0.0 0.0.0.0 dhcp ! access-list 23 permit 10.42.0.0 access-list 110 permit ip 192.168.42.0 0.0.0.255 any access-list 110 permit ip 172.16.42.0 0.0.0.255 any access-list 110 permit ip 10.0.42.0 0.0.0.255 any access-list 110 permit ip 10.42.0.0 0.0.0.255 any access-list 110 deny ip any any no cdp run ! ! ! ! route-map COX_NAT permit 10 match ip address 110 match interface FastEthernet4
I am at a complete loss of what I am doing wrong.