topic Re: Switch to ASA Ping in Network Security

Switch to ASA Ping

NIKHIL M K — Wed, 14 Jun 2023 09:07:47 GMT

Hi Guys,

Getting this log on ASA while I'm trying to ping from switch that attached to ASA and new ASA interface. Could you please advise?

Thanks

Nik

Re: Switch to ASA Ping

Rob Ingram — Wed, 14 Jun 2023 09:19:27 GMT

@NIKHIL M K does the ASA have a route to the IP address mentioned in the output of the logs?

From the ASA you can run packet tracer to simulate the traffic flow, this would indicate a routing or NAT issue that might produce this event log.

Re: Switch to ASA Ping

MHM Cisco World — Wed, 14 Jun 2023 11:01:26 GMT

Instead of use

Ping x.xx.x

Use

Ping -> enter then select the destiantion and source of your ping' make source ip of interface direct connect to SW.

Share result

Re: Switch to ASA Ping

NIKHIL M K — Wed, 14 Jun 2023 10:50:14 GMT

Thanks for the response. Yes we do have route to ASA. This error was getting while I'm ping from the switch to one of the ASA interface.

Re: Switch to ASA Ping

Rob Ingram — Wed, 14 Jun 2023 11:08:14 GMT

@NIKHIL M K to which ASA interface were you pinging?

You can ping the ASA interface you are connected behind (i.e., inside), but you cannot be connected behind the inside interface and ping through the ASA to one of the ASA's other interfaces (outside/dmz etc), that will not work by default.

"The ASA only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface". https://www.cisco.com/c/en/us/td/docs/security/asa/asa919/configuration/firewall/asa-919-firewall-config/access-rules.html