topic Re: Deny inbound icmp src inside:IP dst interface:IP in Network Security

Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Thu, 17 Mar 2022 23:42:47 GMT

Hello all,

I am having an issue with ASA5505 firewall setup. We have plenty of interfaces which works fine (likely same configurations, likely same ACL's as letting interface hosts reach required points)

I am able to ping 3 different devices from ASA with their interfaces but I am able only able to ping 2 of them from Core switch. Core switch has the route for ASA inside interface.

The log says "Deny inbound icmp src inside:core-switch dst interfaceM:IP-hostM(type 8, code 0)"

Any ideas as I am lost where this specific interfaceM doesn't work but others works as normal.

Thanks

Re: Deny inbound icmp src inside:IP dst interface:IP

Rob Ingram — Wed, 16 Mar 2022 11:18:58 GMT

@Orcun Colakoglu do you mean you are connected to the core switch and you are pinging the individual ASA interfaces? That won't work, by design, you can only ping the ASA's interface you (the core switch) is directly behind. You cannot ping through the ASA to one of the ASA's far interfaces.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Wed, 16 Mar 2022 11:26:58 GMT

Hello @Rob Ingram , thanks for the reply.

Yes, I can't ping 3 ASA interfaces which my hosts are inside from Core-Switch which is normal as you mention.

Inside ASA, we have multiple interfaces and when I try to ping hosts which are under same interfaces, I can ping them.

Inside Core-Switch, we have same vlans, only vlan looking to ASA inside interface has IP address for management and ip routing is enabled. When I try to ping same 3 hosts with source as core switch management vlan ip;

2 of them responds normally
1 of them doesnt responds and drops and I see below log on ASA when I filter with source IP address of the host pinged;
- "Deny inbound icmp src inside:core-switch dst interfaceM:xx.xxx.xxx.xx(type 8, code 0)"

Re: Deny inbound icmp src inside:IP dst interface:IP

Rob Ingram — Wed, 16 Mar 2022 11:30:59 GMT

@Orcun Colakoglu note sure what you are saying, are you connected on the inside of one ASA interface and pinging another ASA interface? If yes, that won't work.

If no, provide configs of switch and ASA and information on what you are pinging and from where.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Thu, 17 Mar 2022 23:42:08 GMT

-- wrong --

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 12:01:39 GMT

check the Native VLAN, are the source of ping is Native VLAN ?
try not use native VLAN with ASA, the ASA do not support in some case the untag frame.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Wed, 16 Mar 2022 15:01:35 GMT

This doesn't reflect any solution nor about the issue I am having.

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 15:15:58 GMT

you mention that you use trunk with ASA, are you use native VLAN of this trunk as sub interface in ASA?

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Thu, 17 Mar 2022 23:41:25 GMT

After making some ACL changes, I am now gettin below error;

6 Mar 16 2022 07:45:27 302021 core-switch 0 IP-hostM 0 Teardown ICMP connection for faddr core-switch/0 gaddr IP-hostM/0 laddr IP-hostM/0 type 8 code 0

As I don't have access to hostM device, I believe hostM device has configuration which prevents other networks traffic by firewall or software. Could it be?

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 16:13:12 GMT

https://www.petenetlive.com/KB/Article/0000914

ICMP inspect default must enable.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Wed, 16 Mar 2022 16:28:27 GMT

@MHM Cisco Worldit is enabled.

I believe you missed the part that I can ping other hosts hostP, hostS and hostM normally inside from ASA and can't ping hostM from CoreSwitch but can ping hostP and hostS. Thanks.

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 16:41:45 GMT

Ping from ASA inside interface to all host is ok

Ping from core to any host is drop?

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Wed, 16 Mar 2022 16:54:29 GMT

From ASA, I can ping hostS, hostP, hostM.

From CoreSwitch, I can ping hostS and hostP but can't ping hostM.

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 17:27:02 GMT

before I want to make you note that ASA have two ICMP check mode
the ICMP PASS THROUGH ASA different than ICMP FROM ASA.

there are two policy drop the traffic,
the security level which is default behavior for ASA
if the traffic go from High to low security level here the ICMP inspect work and traffic allow

what if we apply ACL in interface <-the interface that drop ICMP echo reply
the default behavior of ASA is change and now depend on ACL apply to interface.

so what should we do you must allow return Echo reply from interface to Core.

check if you have any ACL apply to this interface, then config it to allow echo reply.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Wed, 16 Mar 2022 17:44:50 GMT

My inside interface has security-level 80 and CoreSwitch also belongs to this network.

Other interfaces InterfaceS, InterfaceP and InterfacesM has security-level 100

Below configurations are also in place;

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
policy-map global_policy
- class inspection_default
  - inspect icmp
  - inspect icmp error

For these 3 interfaces I don't have any echo-return ACL;

interfaceS and interfaceP responds to CoreSwitch ping requests
interfaceM doesn't responds to CoreSwitch ping requests

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 17:53:33 GMT

Core Interface have lower security level 80 than the other port,
so there must ACL allow the ICMP from Core interface to other Interface <high Security 100>.
check this ACL if it allow Core->Host ICMP.

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Wed, 16 Mar 2022 20:13:23 GMT

packet-tracer input <Core> icmp <IP of Core> 8 0 <IP of Host> detailed
please do this packet-tracer and share output here, this give us hint were the packet is drop.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Thu, 17 Mar 2022 23:40:24 GMT

Here you go;

packet-tracer input inside icmp CoreSwitch 8 0 hostM detailed

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: M
output-status: up
output-line-status: up
Action: allow

As I don't have access to remote host, I believe something else is blocking it. May be a firewall, rule or software on the hostM.

Re: Deny inbound icmp src inside:IP dst interface:IP

MHM Cisco World — Thu, 17 Mar 2022 09:10:06 GMT

Hi friend
do same packet-tracer and check other interface that work,
under the NAT rule there is deny=true <- this may be issue
under the IP Option there is deny=true <-this may be issue
so we need to make check with other work interface.

Re: Deny inbound icmp src inside:IP dst interface:IP

Orcun Colakoglu — Thu, 17 Mar 2022 23:37:56 GMT

-- wrong --