topic Re: Firepower Ping in Network Security

Firepower Ping

Juraj Papic — Tue, 24 May 2022 17:54:22 GMT

Hi all,

I my firewall (Firewpower) in the G0/0 I configured the interface 192.168.100.250/24, this is directly connected do my router 192.168.100.245/24 , from the Firewall I can ping my interface but I cant ping the ip from the router, I also tried this from the expert mode and same issue.

Thanks in advance for any help.

Re: Firepower Ping

Flavio Miranda — Tue, 24 May 2022 18:02:37 GMT

Usually icmp is denied by default on firewall for security reason. You can permit it. Try to add this ACL and apply it to the outside interface.

ASA(config)#access-list ACL-OUTSIDE extended permit icmp any any
ASA(config)#access-group ACL-OUTSIDE in interface outside

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 18:10:00 GMT

Hello,

This is a Firepower not the asa, I configure a Policy to permit any any.

thanks.

Re: Firepower Ping

Rob Ingram — Tue, 24 May 2022 18:17:50 GMT

@Juraj Papic by default you should be able to ping the Firepower device.

What hardware appliance are you using?

Are you using FMC or FDM to manage the firewall?

Do you mean you can ping the Firewalls own IP address from the firewall itself?

...but you cannot ping to the router or do you mean you cannot ping from the router to the firewall?

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 18:21:24 GMT

Im usgin FMC to manage the firewll from the CLI I can ping my interface , but I cant ping the router connected to that interface,

thanks.

Re: Firepower Ping

Rob Ingram — Tue, 24 May 2022 18:25:12 GMT

@Juraj Papic which interface have you configured, the data interface or the mgmt interface?

If using the data interface using ping <ip address> or if using the mgmt interface using ping system <ip address>

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 18:28:01 GMT

Im testing the ping to the G0/0 this is connected to my router, and I tryed both option ping IP and ping system IP, with both options I have no answer from the Router.

thanks.

Re: Firepower Ping

Rob Ingram — Tue, 24 May 2022 18:30:22 GMT

@Juraj Papic what have you configured data and/or mgmt interfaces?

Provide the output of "show network" and "show interface ip brief" from the Firewall

And the configuration of the router interface that connects to the firewall.

Re: Firepower Ping

MHM Cisco World — Tue, 24 May 2022 19:24:59 GMT

I one time see same case,

When we do packet tracer from one ip to any interface ip in asa, the asa refuse ping packet simply drop.

So are you use this interface ip for managment?

Re: Firepower Ping

Eric R. Jones — Tue, 24 May 2022 20:57:37 GMT

Is ICMP disabled by default on outside interfaces?

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 21:03:46 GMT

I will sent it right now.

thanks.

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 21:04:15 GMT

No sir,, it not the Mgmt.

thanks.

Re: Firepower Ping

Juraj Papic — Tue, 24 May 2022 21:06:49 GMT

This will be to the Inside Interface and I enabled a policy to accept any / any

Re: Firepower Ping

MHM Cisco World — Tue, 24 May 2022 21:39:01 GMT

Are you config icmp inspection?

Re: Firepower Ping

Sheraz.Salim — Tue, 24 May 2022 22:37:53 GMT

curious could be cable issue on the router as they connected directly as you mentioned in your post.

Re: Firepower Ping

MHM Cisco World — Tue, 24 May 2022 22:47:25 GMT

additional to what Mr.@Sheraz.Salim mention are the router interface is UP/UP??

Re: Firepower Ping

Marius Gunnerud — Wed, 25 May 2022 22:21:59 GMT

Have you checked the ARP table and made sure that the IP to MAC mapping is correct on both the firewall and the router?