topic ASA: Not getting Internet Access on the Server. in Network Security

ASA: Not getting Internet Access on the Server.

vikrammurudkar7589 — Mon, 20 Sep 2021 07:04:32 GMT

Hi All,

I'm currently having issue where the System Admin is having difficulty in getting internet access. A rule was created on the Cisco ASA to allow internet access to the Server but the System Admin is not getting internet access but when we do the testing with the packet-tracer command using both the icmp & tcp; it was showing all allowed.

But, when did the packet capture on the ASA, we're able to see the icmp echo-request but not the icmp echo-reply in both capin & capout.

What can be the reason for this? Can anyone tell what can be the reason for this?

Thanks & Regards,

Vikram Murudkar.

Re: ASA: Not getting Internet Access on the Server.

Karsten Iwen — Mon, 20 Sep 2021 08:57:51 GMT

Often enough it is a destination that just does not answer on Pings. Have you tested real traffic?

For ICMP, did you enable the inspection on the ASA?

Re: ASA: Not getting Internet Access on the Server.

Marvin Rhoads — Mon, 20 Sep 2021 09:46:09 GMT

Is there a static NAT rule for the server in addition to the ACL entry?

Please share the relevant configuration commands you are using.

Re: ASA: Not getting Internet Access on the Server.

John Hinckley — Mon, 20 Sep 2021 17:01:21 GMT

I second what Karsten said. If you don't have ICMP inspection turned on, you typically won't get replies without a permissive ACL. You should also verify that you are allowing echo replies to the outside interface in the SSH config.