topic Re: Backup WAN is not pingable on ASA in Network Security

Backup WAN is not pingable on ASA

Matt — Fri, 21 Feb 2020 14:38:00 GMT

I have an ASA with two WAN uplinks. The backup WAN is not pingable while the primary WAN is. However, I can SSH into the ASA on either uplink. I've seen a few articles saying that this behavior is expected and I was wondering if anyone could explain why I cannot ping the backup WAN even though I can SSH to it. Is there a routing condition that affects pings but not SSH in this case, or is there something else I am missing?

Re: Backup WAN is not pingable on ASA

Flavio Miranda — Fri, 03 Nov 2017 11:50:23 GMT

Hi @Matt

Firewall does not allow for ping on the outside interfaces for security reason. Most exploit tools use icmp response to make sure host is alive and start scratching.

If this is necessary for some reason try to allow it:

icmp permit any unreachable outside

icmp permit any time-exceeded outside

icmp permit any echo-reply outside

no icmp deny any outside

-If I helped you somehow, please, rate it as useful.-

Re: Backup WAN is not pingable on ASA

Matt — Fri, 03 Nov 2017 15:03:47 GMT

Hi Flavio,

That ICMP access is already permitted. Both the WAN1 and WAN2 use the same access-group to permit this traffic so in this case I think it's something outside of the access rules causing it to be unpingable.

Re: Backup WAN is not pingable on ASA

Flavio Miranda — Fri, 03 Nov 2017 20:14:25 GMT

Are you inspecting icmp on this firewall ?