Cisco ASA allowing icmp from inside to any outside only

Mistery — Tue, 25 Feb 2020 18:35:57 GMT

Hello all, I am trying to setup Cisco ASA 5510 to allow ICMP protocol from inside to any outside hosts only. I have been able to deny ICMP from outside, however I am unable to allow from inside. Any hints would be much appreciated.

Re: Cisco ASA allowing icmp from inside to any outside only

Rob Ingram — Tue, 25 Feb 2020 18:41:07 GMT

Hi,

To permit inside hosts pinging devices on the outside you need to permit ICMP echo-replies inbound on the outside interface. E.g

access-list OUTSIDE_IN extended permit icmp any any echo-reply
access-group OUTSIDE_IN in interface OUTSIDE

Alternatively you could run the command fixup protocol icmp to inspect ICMP traffic and permit the return ICMP echo replies.

policy-map global_policy
 class inspection_default
 inspect icmp

HTH

topic Cisco ASA allowing icmp from inside to any outside only in Network Security

Cisco ASA allowing icmp from inside to any outside only

Re: Cisco ASA allowing icmp from inside to any outside only