topic Re: Enable Ping interface WAN (Firepower FMC) in Network Security

Enable Ping interface WAN (Firepower FMC)

FranciscoOpenLink — Fri, 08 Jul 2022 18:54:15 GMT

Hello, I am trying to ping the WAN interface of a Firepower in a laboratory and it blocks the traffic.

I have another firepower but this one is not added to the FMC and the ping works without problem, I already enabled the ping in the FMC and created a rule that allows everything and it doesn't work.

Re: Enable Ping interface WAN (Firepower FMC)

Rob Ingram — Fri, 08 Jul 2022 19:00:46 GMT

@FranciscoOpenLink

Ping would be permitted as default to the FTD.

Where did you configure the ping rules? ICMP (ping) is controlled via the Platform Settings not the Access Control Policy (ACP).

Where are you pinging from?

What interface are you connected to?

You'd only be able to ping the WAN interface if you were connected behind that interface, you could not be connected behind another FTD interface (i.e., INSIDE) and ping the WAN interface, that will not work by design.

Re: Enable Ping interface WAN (Firepower FMC)

FranciscoOpenLink — Fri, 08 Jul 2022 19:09:19 GMT

Hello, I am pinging from another Firepower that I have connected via WAN on the same network segment.

I show you the rules I create

Re: Enable Ping interface WAN (Firepower FMC)

FranciscoOpenLink — Fri, 08 Jul 2022 19:11:45 GMT

connect a virtual machine to that interface to check and it doesn't work either.

Re: Enable Ping interface WAN (Firepower FMC)

Rob Ingram — Fri, 08 Jul 2022 19:15:48 GMT

@FranciscoOpenLink what is the configuration of the ICMP service "permitICMP"? if it's incorrect, there is an implicit deny, so the traffic will be dropped.

The ACP policy is not applicable when controlling traffic to the FTD's interface.

Re: Enable Ping interface WAN (Firepower FMC)

FranciscoOpenLink — Fri, 08 Jul 2022 19:21:32 GMT

I am allowing ICMP in that policy

Re: Enable Ping interface WAN (Firepower FMC)

MHM Cisco World — Fri, 08 Jul 2022 20:35:29 GMT

some times the PC OS FW drop ICMP, disable FW or allow ping.