Pinging Through The Fwsm - Cisco 7604 Configuration Manual

Testing Your Configuration
Figure 26-3
Host
Ping each FWSM interface from a remote host. For transparent mode, ping the management IP address.
Step 3
This test checks that the directly connected router can route the packet between the host and the FWSM,
and that the FWSM can correctly route the packet back to the host.
A ping might fail if the FWSM does not have a route back to the host through the intermediate router
(see
log message 110001 indicating a routing failure.
Figure 26-4
MSFC

Pinging Through the FWSM

After you successfully ping the FWSM interfaces, you should make sure traffic can pass successfully
through the FWSM. For routed mode, this test shows that NAT is working correctly, if configured. For
transparent mode, which does not use NAT, this test confirms that the FWSM is operating correctly; if
the ping fails in transparent mode, contact Cisco TAC.
To ping between hosts on different interfaces, perform the following steps:
To add an access list allowing ICMP from any source host, enter the following command:
Step 1
hostname(config)# access-list ICMPACL extended permit icmp any any
By default, when hosts access a lower security interface, all traffic is allowed through. However, to
access a higher security interface, you need the preceding access list.
To assign the access list to each source interface, enter the following command:
Step 2
hostname(config)# access-group ICMPACL in interface interface_name
Repeat this command for each source interface.
Step 3 To enable the ICMP inspection engine, so ICMP responses are allowed back to the source host, enter the
following commands:
hostname(config)# class-map ICMP-CLASS
hostname(config-cmap)# match access-list ICMPACL
hostname(config-cmap)# policy-map ICMP-POLICY
hostname(config-pmap)# class ICMP-CLASS
hostname(config-pmap-c)# inspect icmp
hostname(config-pmap-c)# service-policy ICMP-POLICY global
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
26-4
Ping Failure Because of IP Addressing Problems
Ping
MSFC
Figure 26-4). In this case, the debug messages show that the ping was successful, but you see system
Ping Failure Because the FWSM has no Route
Ping
Chapter 26
MSFC
FWSM
Troubleshooting the Firewall Services Module
Host
FWSM
OL-20748-01