Cisco 500 Series, Configuration Manual

Page: 963 / 1140

43-3
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 43 Troubleshooting the Security Appliance
Testing Your Configuration
Figure 43-1 Network Diagram with Interfaces, Routers, and Hosts
Step 2 Ping each security appliance interface from the directly connected routers. For transparent mode, ping
the management IP address. This test ensures that the security appliance interfaces are active and that
the interface configuration is correct.
A ping might fail if the security appliance interface is not active, the interface configuration is incorrect,
or if a switch between the security appliance and a router is down (see
Figure 43-2 ). In this case, no
debug messages or system log messages appear, because the packet never reaches the security appliance.
Figure 43-2 Ping Failure at Security Appliance Interface
If the ping reaches the security appliance, and the security appliance responds, debug messages similar
to the following appear:
ICMP echo reply (len 32 id 1 seq 256) 209.165.201.1 > 209.165.201.2
ICMP echo request (len 32 id 1 seq 512) 209.165.201.2 > 209.165.201.1
If the ping reply does not return to the router, then a switch loop or redundant IP addresses may exist
(see
Figure 43-3 ).
Routed Security
Appliance
10.1.1.56 10.1.3.6 209.265.200.230
10.1.2.90 10.1.4.67 10.1.0.34
209.165.201.24
10.1.1.5
Transp. Security
Appliance 10.1.0.3
Host
Host
10.1.1.2
192.168.1.2
209.265.200.226
209.165.201.2
10.1.3.2
192.168.3.2
192.168.2.2
10.1.2.2
192.168.0.2
10.1.0.2
192.168.4.2
10.1.4.2
dmz1
192.1
68.1.
outside
209.165.201.1
security0
inside
192.168.0.1
security100
209.165.201.1
10.1.0.1
10.1.0.2
10.1.1.1
outside
security0
inside
security100
dmz2
192.168.2.1
security40
dmz3
192.1
68.3.
dmz4
192.168.4.1
security80
126692
Host Host
Host
Host
Host
Host
Router
Router Router
Router
Router Router
Router
Router
Ping
Security
Appliance
Router
126695