problemi con il nat

[ico78]

Ciao a tutti,

sto provando a configurare il mio firewall per far in modo di accedere ad un pc sulla mia rete privata con indirizzo 192.168.0.x dall'esterno utilizzando un nat con un indirizzo pubblico 195.60.xx.xx.
Quello che mi succede e che riesco e penso che il nat sia funzionando perchè dalla stessa rete dmz riesco a pingare l'indirizzo nattato (195.60.xx.xx) con quello privato e il tutto funziona ma se provo a pingare dall'esterno o dalla stessa rete interna 192.168.0.xx il pc non risponde.
dal log l'unica cosa che noto è il seguente errore
2006-11-07 13:17:37 Local4.Error 192.168.0.1 %PIX-3-305006: regular translation creation failed for icmp src inside:192.168.0.50 dst outside:82.55.253.218 (type 0, code 0)
E legata al problema che sto riscontrando?

Vi ringrazio in anticipo

ciao

[[Dj][DMX]]

Mostraci la configurazione please, potrebbe essere un problema di firewall che non prevede la risposta al ping!

[ico78]

: Saved
: Written by enable_15 at 17:42:19.538 UTC Wed Jan 6 1993
!
PIX Version 7.1(2)
!
interface Ethernet0
nameif dmz
security-level 40
ip address 195.60.xx.2 255.255.255.240
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet2
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface Ethernet3
nameif rsr
security-level 50
ip address xx.xx.xx.xx 255.255.255.240
!
interface Ethernet4
shutdown
nameif dmz-in
security-level 40
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
passwd VDfp/IokdTMuiPA9 encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name xxx.local
object-group network clusterweb
network-object web1 255.255.255.255
network-object web2 255.255.255.255
network-object webcluster 255.255.255.255
object-group service web tcp
port-object eq https
port-object eq www
object-group service portalearea tcp
description porte 80 e 1500 verso il portale web di xxx
port-object range 1500 1500
port-object eq www
object-group service telefoni tcp
port-object eq telnet
port-object eq 4100
port-object eq 5000
access-list dmz_inside extended permit tcp object-group clusterweb host 195.60.xx.2 eq 1238
access-list dmz_inside extended permit tcp host 195.60.xx.7 host 195.60.xx.8 eq sqlnet
access-list dmz_inside extended permit tcp host 195.60.xx.6 host 138.66.34.70 object-group web
access-list dmz_inside extended permit tcp host 195.60.xx.7 host 138.66.34.70 object-group web
access-list dmz_inside extended permit tcp host 195.60.xx.11 host 195.60.xx.8 eq sqlnet
access-list dmz_inside extended deny ip any any
access-list PING extended permit icmp any any
access-list dmz_access_in extended permit tcp host 195.60.xx.11 host 195.60.xx.8 eq sqlnet
access-list dmz_access_in extended permit tcp host 195.60.xx.7 host 138.66.34.70
access-list dmz_access_in extended permit tcp host 195.60.xx.6 host 138.66.34.70
access-list dmz_access_in extended permit tcp host 195.60.xx.7 host 195.60.xx.8 eq sqlnet
access-list dmz_access_in extended permit icmp any any
access-list dmz_access_in extended deny tcp any any
access-list outside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any log debugging
access-list dmz_access_in_V1 extended permit tcp host web1 interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host webcluster interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host web2 interface dmz eq 1238
access-list dmz_access_in_V1 extended permit tcp host 195.60.xx.11 host 195.60.xxx.8 eq sqlnet
access-list dmz_access_in_V1 extended permit tcp host 195.60.xx.7 host 195.60.xx.8 eq sqlnet
access-list dmz_access_in_V1 extended permit tcp host 195.60.xxx.7 host 138.66.34.70 object-group web
access-list dmz_access_in_V1 extended permit tcp host 195.60.xx.6 host 138.66.34.70 object-group web
access-list dmz_access_in_V1 extended permit icmp any any
access-list dmz_access_in_V1 extended deny ip any any
access-list 120 standard permit host 192.168.0.111
access-list rm_test standard permit host 192.168.0.111
access-list rm_test standard deny any
access-list gw_test standard permit host 195.60.xx.1
access-list gw_test standard deny any
access-list dmz_access_in_V2 extended permit tcp object-group clusterweb interface dmz
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.11 host 195.60.xxx.8 eq sqlnet
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.12 host 195.60.xx.12
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.7 host 195.60.xx.8 eq sqlnet
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.7 host 138.66.34.70 object-group web
access-list dmz_access_in_V2 extended permit tcp host 195.60.xx.6 host 138.66.34.70 object-group web
access-list dmz_access_in_V2 extended permit icmp any any
access-list inside_nat0_outbound extended permit ip any 192.168.0.192 255.255.255.224 inactive
access-list inside_nat0_outbound extended permit ip host 192.168.0.25 host 10.2.2.1 inactive
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.192 255.255.255.224 inactive
access-list test extended permit tcp object-group clusterweb host 195.60.xx.2 eq 1238
access-list accesso extended permit tcp host 195.60.xx.11 host 195.60.xx.8 eq sqlnet
access-list accesso extended permit tcp host 195.60.xx.7 host 195.60.xx.8 eq sqlnet
access-list accesso extended permit tcp host 195.60.xx.6 host 138.66.34.70 object-group web
access-list accesso extended permit tcp host 195.60.xx.7 host 138.66.34.70 object-group web
access-list accesso extended permit icmp any any
pager lines 24
logging enable
logging trap informational
logging asdm informational
logging host inside 192.168.0.50
mtu dmz 1500
mtu inside 1500
mtu outside 1500
mtu rsr 1500
mtu dmz-in 1500
ip local pool testpool 192.168.0.200-192.168.0.210 mask 255.255.255.0
no failover
icmp permit any echo dmz
asdm image flash:/asdm
asdm location 195.60.xx.8 255.255.255.255 inside
asdm location web1 255.255.255.255 dmz
asdm location web2 255.255.255.255 dmz
asdm location webcluster 255.255.255.255 dmz
asdm location 195.60.xx.2 255.255.255.255 inside
asdm location 138.66.34.70 255.255.255.255 outside
asdm location 192.168.0.25 255.255.255.255 inside
asdm location 192.168.0.11 255.255.255.255 inside
asdm location 192.168.0.61 255.255.255.255 inside
asdm location 192.168.0.2 255.255.255.255 inside
asdm location 192.168.0.20 255.255.255.255 inside
asdm location 195.60.xx.12 255.255.255.255 dmz
asdm location 192.168.0.24 255.255.255.255 inside
asdm location 192.168.0.9 255.255.255.255 inside
asdm location 192.168.0.8 255.255.255.255 inside
asdm location 162.168.0.61 255.255.255.255 inside
asdm location 192.168.0.192 255.255.255.224 dmz
asdm group clusterweb dmz
no asdm history enable
arp dmz 195.60.xx.12 000d.8811.bb50 alias
arp timeout 14400
nat-control
global (dmz) 1 interface
global (outside) 1 interface
global (rsr) 1 interface
global (dmz-in) 1 interface
nat (dmz) 1 195.60.xx.6 255.255.255.255
nat (dmz) 1 195.60.xx.7 255.255.255.255
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,dmz) tcp interface 1238 192.168.0.2 1238 netmask 255.255.255.255
static (inside,dmz) 195.60.xx.8 192.168.0.61 netmask 255.255.255.255
static (inside,dmz) 195.60.xx.12 192.168.0.50 netmask 255.255.255.255
access-group accesso in interface dmz
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy test internal
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs enable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
client-firewall none
client-access-rule none
username admin password 7KKG/zg/Wo8c.YfN encrypted
username cosimo password Kk2BUp/zZX.xc/cx encrypted privilege 0
username cosimo attributes
vpn-group-policy test
http server enable
http 192.168.0.111 255.255.255.255 inside
http 192.168.0.55 255.255.255.255 inside
http 192.168.0.50 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map dmz_dyn_map 20 set transform-set ESP-DES-SHA
crypto map dmz_map 65535 ipsec-isakmp dynamic dmz_dyn_map
crypto map dmz_map interface dmz
isakmp enable dmz
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
tunnel-group test type ipsec-ra
tunnel-group test general-attributes
address-pool testpool
default-group-policy test
tunnel-group test ipsec-attributes
pre-shared-key cosimo
telnet 192.168.0.55 255.255.255.255 inside
telnet 192.168.0.50 255.255.255.255 inside
telnet 192.168.0.111 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global

: end

[Wizard]

prova ad abilitare il fixup sull' icmp error su nat

[Wizard]

Scusami, i fixup c'erano sulla versione 6.3 dei pix, sulla 7 c'è la inspection, configura l'inspection anche sull' icmp