topic Re: how to edit fmc inspection policy for ping ? in Network Security

how to edit fmc inspection policy for ping ?

baselzind — Fri, 21 Feb 2020 16:29:20 GMT

i have fmc with Cisco Firepower 2110 ftd , i can browse the internet from inside fine but i cannot ping any outside ip address , i think it is denied in the inspection policy but i cant seem to find it in the fmc? where is the inspection policy in fmc?

Re: how to edit fmc inspection policy for ping ?

Abheesh Kumar — Tue, 20 Nov 2018 17:09:06 GMT

Hi,
You can enable disable inspection policy from cli.
> configure inspection icmp disable

You can also create flex config to disable inspections. Create flex config as below and bind to FTD

policy-map global_policy
class inspection_default
no inspect icmp

HTH

Abheesh

Re: how to edit fmc inspection policy for ping ?

baselzind — Mon, 26 Nov 2018 10:02:06 GMT

is "> configure inspection icmp disable" done on ftd or fmc , and if on fmc how do i do it as it isnt accepting it , i think there is pre-commands to be able to insert it as im getting the input in this form "admin@firepower:~$"?

Re: how to edit fmc inspection policy for ping ?

Abheesh Kumar — Mon, 26 Nov 2018 10:37:17 GMT

You need to do it on FTD not FMC.

You can also create a rule in ACP to allow ping.

HTH

Abheesh

Re: how to edit fmc inspection policy for ping ?

Marvin Rhoads — Mon, 26 Nov 2018 11:19:49 GMT

You need to "inspect icmp" for ping to work.

Otherwise the FTD doesn't keep track of the icmp flows and thus when the icmp echo reply is received it is not recognized as part of an existing flow and is dropped.

Note if you want traceroute to work, even more configuration is required. Paul Stewart explains how here:

https://packetu.com/2018/08/12/traceroute-through-firepower-threat-defense/