[nsp] PIX only avail after pinging from it

[Sven Huster]

Hi

I got a PIX/UR running 6.3(1).

It looks like it is only available e.g. for ICMP once it pinged the other end first.
So I try to ping it and leave this running without any success.
As soon as I ping the host from the PIX it also start to work the other way round.

Any ideas?

Part of the config follows:

interface ethernet0 100full
interface ethernet1 100full
interface ethernet1 vlan2 logical
interface ethernet1 vlan3 logical

nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan2 dmz security10
nameif vlan3 internal security90

access-list compiled
access-list ACL_OUTSIDE_IN permit icmp any any
access-list ACL_OUTSIDE_IN permit ip host 10.0.0.1 any
access-list ACL_OUTSIDE_IN permit ip host 10.0.0.2 any
access-list ACL_DMZ_IN deny ip 192.168.254.0 255.255.255.0 192.168.254.0 255.255.255.0
access-list ACL_DMZ_IN permit icmp any any
access-list ACL_DMZ_IN permit ip any host 10.0.0.1
access-list ACL_DMZ_IN permit ip any host 10.0.0.2
access-list ACL_DMZ_IN permit udp any host 10.1.1.4 eq domain
access-list ACL_DMZ_IN permit udp any host 10.1.1.5 eq domain

icmp permit any outside
icmp permit any inside
icmp permit any dmz
icmp permit any internal

mtu outside 1500
mtu inside 1500

ip address outside 10.0.0.250 255.255.255.0
ip address inside 192.168.155.254 255.255.255.0
ip address dmz 192.168.254.254 255.255.255.0
ip address internal 192.168.151.254 255.255.255.0

arp timeout 14400
static (dmz,outside) 10.0.0.50 192.168.254.1 netmask 255.255.255.255 0 0

access-group ACL_OUTSIDE_IN in interface outside
access-group ACL_DMZ_IN in interface dmz

route outside 0.0.0.0 0.0.0.0 10.0.0.254 1

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

Thanks 
Regards
--
Sven