cannot ping package IP

[Rgomes]

Hi All,

how can I ping a floating IP outside from PIX. I can ping both, primary node and adaptive node.

Thanks in advance,

Richard

[U.SivaKumar_2]

Hi,

Are you using NAT ( netwoork address translation) in cisco PIX ?.

Have try clearing ARP cache of cisco PIX ?

clear arp-cache


regards,
U.SivaKumar

[Rgomes]

Hi SivKumar,

Actually I posted this problem on dec 01, 2002, but I cannot check my previous mail on itrc-->service guard section, the mail just vanished! I don't know why.

Whatever, Yes, I tried that. We are sure That the problem is with PIX, because after removing the PIX from Network it works fine, from different subnet we can ping any IP address including PAckage IP.

Haven;t been able to find out what is the problem with PIX.

Thanks and regards

Richard

[U.SivaKumar_2]

Are you using NAT ( netwoork address translation) for virtual IP address in cisco PIX ?.

[U.SivaKumar_2]

Hi richard,

Have you enabled proxy-arp in both external and internal interface of cisco PIX ?

if yes , try disabling proxy-arp in the internal interface .

sysopt noproxyarp

have you configured that server cluster's floating IP address using cisco PIX or using some other clustering software running in the nodes ?

Have you put NAT configuration entries for the floating IP address in cisco PIX to access it from outside network ?

Also have you tried this.

1) Shutdown the cluster nodes .
2) Reboot Cisco PIX and let cisco PIX boot completely.
3) start the nodes with floating IP address

Now this nodes will send a gratuitous ARP for the floating IP address which will properly update the cisco PIX 's arp cache with floating IP address. Try to ping the floating ip address now . whats the result ?

regards,
U.SivaKumar

[Ron Kinner · Accepted solution]

Your original post is:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4a97afe90f1cd71190050090279cd0f9,00.html

Not sure about a PIX but on a Cisco you can look at the arp table with:
show arp

If you don't find the MAC and IP address of your package in the table then you can put it in by going into conf mode and doing:

arp A.B.C.D MAC arpa

Another thing to look out for is the case where someone has put in a static route to the package IP on a router which is part of a dyanmic routing scheme such as EIGRP but where the router is not directly connected to the package's LAN. This can cause a very frustrating loop. You can test for this (again I only speak Cisco router IOS not PIX} by adding a route on the router (PIX) directly connected to the package's LAN.

PIX's do not much like ICMP by default so you probably have to tell them it is ok to pass echo and echo replies to and from the package IP.

Ron