Hi all,

We've had a network add and have two inline firewalls. On the second
firewall it appears that our inbound access-list is not working.

To test we've currently got:

access-list inside_in extended deny ip any any log
access-group inside_in in interface inside

The problem we have is that we can still ping the second firewall even
though all IP traffic should be denied. Has anyone ever come across
this, and if so, do they know of a fix?

We do have a second access-list called outside_in which is applied
inbound on the outside interface. Could this cause a conflict?

Many thanks,

Chris

In article <1184088852.924846.276930 [at] o61g2000hsh.googlegroups.com>,
Chris <christopher.bloomfield [at] bt.com> wrote:

>We've had a network add and have two inline firewalls. On the second
>firewall it appears that our inbound access-list is not working.

>To test we've currently got:
>
>access-list inside_in extended deny ip any any log
>access-group inside_in in interface inside

That's an outbound access-list, not an inbound access-list.

>The problem we have is that we can still ping the second firewall even
>though all IP traffic should be denied. Has anyone ever come across
>this, and if so, do they know of a fix?

Pinging a PIX or ASA firewall is not controlled by access-group .
Pinging a PIX or ASA firewall is controlled by the 'icmp' command.

On 11 Jul, 06:56, rober... [at] hushmail.com (Walter Roberson) wrote:
> In article <1184088852.924846.276... [at] o61g2000hsh.googlegroups.com>,
>
> Chris <christopher.bloomfi... [at] bt.com> wrote:
> >We've had a network add and have two inline firewalls. On the second
> >firewall it appears that our inbound access-list is not working.
> >To test we've currently got:
>
> >access-list inside_in extended deny ip any any log
> >access-group inside_in in interface inside
>
> That's an outbound access-list, not an inbound access-list.
>

Sorry, I was implying it was inbound relative to the firewall. But
yes, it is outbound.

> >The problem we have is that we can still ping the second firewall even
> >though all IP traffic should be denied. Has anyone ever come across
> >this, and if so, do they know of a fix?
>
> Pinging a PIX or ASA firewall is not controlled by access-group .
> Pinging a PIX or ASA firewall is controlled by the 'icmp' command.

First I knew of that.

Many thanks,

Chris