topic Re: Not able to ping natted I.P from inside in Network Security

Not able to ping natted I.P from inside

ajaykumar2k1 — Mon, 11 Mar 2019 10:09:39 GMT

we are using ASA5505 having two interfaces inside(Security level 100) outside (security level 50)

We had statically natted I.P X.X.X.X (inside ) to Y.Y.Y.Y (Public I.P).We are able to ping this public I.P from Internet ,also nat is working successfully.

we are able to ping natted I.P from ouside i.e Y.Y.Y.Y but we are not able to ping it from inside .

below is the configuration done

static (inside,outside) Y.Y.Y.Y X.X.X.X netmask 255.255.255.255

Regards

Ajay

Re: Not able to ping natted I.P from inside

zulqurnain — Mon, 07 May 2007 06:20:14 GMT

hello,

i maybe wrong but how could you even ping this natted ip from outside to inside, whereas my understanding says that pix doesn't allow any icmp traffic espacially if coming from higher security interface to lower security interface.

Re: Not able to ping natted I.P from inside

ajaykumar2k1 — Mon, 07 May 2007 08:12:02 GMT

Thanks for your reply

My problem has been resolved .

Regards

Ajay

Re: Not able to ping natted I.P from inside

zulqurnain — Mon, 07 May 2007 11:29:10 GMT

hello,

you are always welcome, but if you don't mind i would really like to know how you solved it.

Re: Not able to ping natted I.P from inside

steve_perrone — Wed, 27 Jun 2007 18:13:00 GMT

We are having the exact same problem.

Could you elaborate on how you solved this issue.

Thank you

Re: Not able to ping natted I.P from inside

acomiskey — Wed, 27 Jun 2007 18:16:17 GMT

Steve, could you elaborate on your problem? How many interfaces are we talking about here? Give us a little more info.

For example if you have 3 interfaces and have

static (dmz,outside) 1.1.1.1 172.16.1.1 netmask 255.255.255.255

You can ping 1.1.1.1 from outside but not from the inside. You would need to add something like this if you wanted to do so....

static (dmz,inside) 1.1.1.1 172.16.1.1 netmask 255.255.255.255

Here are a few options for 2 interfaces

1. dns doctoring

2. hairpinning

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml

Please rate helpful posts

Re: Not able to ping natted I.P from inside

steve_perrone — Wed, 27 Jun 2007 18:24:44 GMT

Well, I guess I got a little trigger happy and sent off this post before reading trough all posts.

I got my answer here

ns&loc=.1dde631e/4&forum=Security&topic=Firewalling

Re: Not able to ping natted I.P from inside

acomiskey — Wed, 27 Jun 2007 18:27:53 GMT

Could you post that link again. Was it the same solution as I posted above?