topic Re: Cisco ASA Public Interface in Network Access Control

Cisco ASA Public Interface

maileh — Mon, 11 Mar 2019 08:47:04 GMT

Is it possible to access from a network behind a Cisco ASA Firewall Lan Interface to its own public IP Interface.

User 10.1.1.100/24 ------------10.1.1.1/24 : LAN FW PUB : 1.1.1.1/32

Is it possible that the user (10.1.1.100) can access to ip 1.1.1.1 of the ASA Public Interface.

Re: Cisco ASA Public Interface

Troy Jackson — Fri, 27 Jul 2018 02:37:14 GMT

No it’s not possible. The ASA will not allow you to reach it’s own interface through the device.

Re: Cisco ASA Public Interface

maileh — Fri, 27 Jul 2018 02:50:25 GMT

Hi Troy

Thanks for your confirmation. Yes thats right and that is what i am experiencing.

I also work with Huawei UDEMON FW which they allowed.

Its really interesting to know why ?

Re: Cisco ASA Public Interface

hslai — Fri, 27 Jul 2018 05:35:56 GMT

The usage guidelines @ icmp -- import webvpn webcontent states,

...

The ASA only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.

...

It's probably due to routing in a stateful firewall, such as ASA.

For network troubleshooting, we may ping another device either in the same public subnet or further upstream.