topic Routing between ASA 5510 interfaces in Network Security

Routing between ASA 5510 interfaces

haytham elsamadony — Mon, 13 Jul 2020 04:55:06 GMT

Hi Guys

I have Cisco ASA 5510 at one of our sites

i have an issue with this asa, the servers at inside zone with 100 level security can`t reach to the outside zone level zero

when i try to ping from the server, it can reach to the inside interface ( his GW ), but i can`t ping the outside interface at same ASA

what i understand that by default this ping should be work because it came from zone with high security level to zone with low security level

Or, there are some routing configuration required between ASA interfaces i should do it

Thanks

Re: Routing between ASA 5510 interfaces

Rob Ingram — Mon, 13 Jul 2020 05:44:48 GMT

Hi,

Are you attempting to ping the ASAs outside interface from a device connected to the inside of the ASA? If so that won’t work (by design).

If you are pinging through the ASA to another device you need to ensure you inspect icmp, use the command “fixup protocol icmp”.

HTH

Re: Routing between ASA 5510 interfaces

haytham elsamadony — Tue, 14 Jul 2020 07:09:44 GMT

yes, i want to ping from device connected to inside interface to outside interface

OK i can`t by design, but if i want to check the connectivity between this device and other behind this firewall

how i can know that the traffic from inside device walk through the firewall to the destination ??

Re: Routing between ASA 5510 interfaces

Rob Ingram — Tue, 14 Jul 2020 07:27:34 GMT

You may not be able to ping the ASAs outside interface when connected to the inside, but you can certainly ping through the ASA - so ping the other device behind the firewall, that will work. For that to work you will need the icmp inspect configured using the command I previously provided "fixup protocol icmp".

HTH

Re: Routing between ASA 5510 interfaces

haytham elsamadony — Tue, 14 Jul 2020 08:00:24 GMT

Ok so what i understand that, to ping the other device behind the firewall i must apply this icmp inspect

and without this command i will not be able to ping through the firewall

is this right ?

Re: Routing between ASA 5510 interfaces

Rob Ingram — Tue, 14 Jul 2020 08:08:28 GMT

Correct.

Alternatively you could explictly permit icmp inbound on the outside interface, however most people enable icmp inspection using the command I provided.

Re: Routing between ASA 5510 interfaces

haytham elsamadony — Tue, 14 Jul 2020 08:18:20 GMT

Ok thanks Rob your replies were very helpful for me

thanks again