topic Cannot ping external DNS servers? in Network Security

Cannot ping external DNS servers?

JJevans_2112 — Fri, 26 Nov 2021 16:34:32 GMT

Hello All,

I cannot ping any external DNS servers like google (8.8.8.8) or comcast (75.75.75.75) or cloudflare (9.9.9.9 or 1.1.1.1) from a PC (192.168.1.5) on the inside interface of Cisco ASA 5506?

I have tried packet tracer and it states its allowed.

Software firewall is turned off on the PC. I am able to browse web sites so DNS seems to be working ok but cannot ping google.com or ip address.

This is really confusing?

Any insight on how I can make them respond to ICMP?

Thank you,

Re: Cannot ping external DNS servers?

Rob Ingram — Fri, 26 Nov 2021 16:47:20 GMT

@JJevans_2112 your packet tracer icmp code syntax is incorrect, it should be 8 0, the output also cannot determine the ingress and egress interfaces.

Run the command "fixup protocol icmp" from the CLI.

If that doesn't work run packet-tracer from the CLI "packet-tracer input inside icmp 192.168.1.5 8 0 8.8.8.8" and provide the full output for review. And also provide your configuration.

Re: Cannot ping external DNS servers?

JJevans_2112 — Fri, 26 Nov 2021 16:59:39 GMT

Hello Rob,

Thank you that helped. But when running packet tracer via CLI I get error:

ciscoasa(config)# packet-tracer input inside icmp 192.168.1.5 8 0 8.8.8.8
ERROR: % Ambiguous command: "packet-tracer input inside icmp 192.168.1.5 8 0 8.8.8.8"

I also do not understand why it cannot determine which ingress / egress interfaces?

I have attached the cleaned config.

Re: Cannot ping external DNS servers?

Rob Ingram — Fri, 26 Nov 2021 17:07:09 GMT

@JJevans_2112 so you can now ping the DNS servers and the initial issue is resolved? - I don't see the configuration in the output

Seems like you've configured a bridge group, so you will need to use the correct name of the interface the device is connected to, example:-

"packet-tracer input inside_1 icmp 192.168.1.5 8 0 8.8.8.8"

"packet-tracer input inside_2 icmp 192.168.1.5 8 0 8.8.8.8"