topic Re: Routing in ASA in Network Security

Routing in ASA

Asfandyar70754 — Mon, 29 Aug 2022 13:16:00 GMT

Hey guys,

So I am a bit new on ASA and was doing a basic lab, topology attached. I have vlan 10 & 20 in my inside network.

Following are the routes that I have configured on ASA, CoreSW & ISP-RTR

Core SW route: ip route 0.0.0.0 0.0.0.0 30.0.0.2

ASA routes:

route outside 0.0.0.0 0.0.0.0 40.0.0.2 1

route inside 10.0.0.0 255.0.0.0 30.0.0.1 1

route inside 20.0.0.0 255.0.0.0 30.0.0.1 1

ISP-RTR route:

ip route 0.0.0.0 0.0.0.0 40.0.0.1

Now I am not able to ping from my internal network to ISP-RTR's IP or it Loopback IP.

What am I missing in m config?

Re: Routing in ASA

MHM Cisco World — Mon, 29 Aug 2022 13:26:38 GMT

You need ICMP inspection

https://www.speaknetworks.com/enable-icmp-inspection-to-allow-ping-traffic-passing-asa/

Re: Routing in ASA

Asfandyar70754 — Tue, 30 Aug 2022 06:04:23 GMT

Thank you for your response.

I also need to know incase there are 2 ISPs then can I use default routes for both ISPs.

route outside 0.0.0.0 0.0.0.0 50.0.0.2 2(Making it a backup route using administrative distance 2)

Re: Routing in ASA

Rob Ingram — Tue, 30 Aug 2022 07:18:16 GMT

@Asfandyar70754 if you want to use both ISP circuits, then you can use IP SLA to track the primary ISP and failover to the secondary if required - example here. Or use Policy Based Routing (PBR) - example here.

Re: Routing in ASA

paul driver — Tue, 30 Aug 2022 07:20:26 GMT

Hello
By default traffic from an asa outside interface (lower security level) isn’t allowed into the fw ( as such icmp reply’s will denied)
You could allow this two ways:

Access-list
access-list x extended permit icmp any any echo-reply
access-group x in interface outside

Service-policy inspection
policy-map global-policy
class insection_default
inspect icmp
inspect icmp-error < hides internal addresing via traceroute
exit

Lastly:
allow traffic between interfaces--- intervlan routing
same-security-traffic permit inter-interface

Allow traffic in/out same interface
same-security-traffic permit intra-interface

Re: Routing in ASA

Khaled Douma — Tue, 30 Aug 2022 08:29:18 GMT

Use "fixup protocol icmp" to start to inspect ICMP protocol