Cisco 500 Series, Configuration Manual

Page: 964 / 1140

43-4
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 43 Troubleshooting the Security Appliance
Testing Your Configuration
Figure 43-3 Ping Failure Because of IP Addressing Problems
Step 3 Ping each security appliance interface from a remote host. For transparent mode, ping the management
IP address. This test checks whether the directly connected router can route the packet between the host
and the security appliance, and whether the security appliance can correctly route the packet back to the
host.
A ping might fail if the security appliance does not have a return route to the host through the
intermediate router (see
Figure 43-4 ). In this case, the debug messages show that the ping was
successful, but system log message 110001 appears, indicating a routing failure.
Figure 43-4 Ping Failure Because the Security Appliance has no Return Route
Pinging Through the Security Appliance
After you successfully ping the security appliance interfaces, make sure traffic can pass successfully
through the security appliance. For routed mode, this test shows that NAT is operating correctly, if
configured. For transparent mode, which does not use NAT, this test confirms that the security appliance
is operating correctly. If the ping fails in transparent mode, contact Cisco TAC.
To ping between hosts on different interfaces, perform the following steps:
Step 1
To add an access list allowing ICMP from any source host, enter the following command:
hostname(config)# access-list ICMPACL extended permit icmp any any
By default, when hosts access a lower security interface, all traffic is allowed through. However, to
access a higher security interface, you need the preceding access list.
Step 2
To assign the access list to each source interface, enter the following command:
hostname(config)# access-group ICMPACL in interface interface_name
Repeat this command for each source interface.
Step 3
To enable the ICMP inspection engine and ensure that ICMP responses may return to the source host,
enter the following commands:
hostname(config)# class-map ICMP-CLASS
hostname(config-cmap)# match access-list ICMPACL
192.168.1.1 192.168.1.2
192.168.1.2
Ping
Router
Security
Appliance
Host
126696
Ping
Router
Host
?
Security
Appliance
126693