topic Re: ASA5506 Access Question in Network Security

ASA5506 Access Question

bwn — Fri, 28 Jul 2023 15:37:15 GMT

We have an ASA5506 and I'm trying to have an IP address that is accessible on the outside interface be accessible on the inside interface. I can ping the address if I select outside interface but there is no response when trying to ping from the inside interface. I'm using the ASDM tool as I don't spend a lot of time managing routers. I tried changing the security level of the outside interface to 100 to match the inside interface as I thought traffic may be allowed if the same security level but that didn't seem to make a difference.

Re: ASA5506 Access Question

Flavio Miranda — Fri, 28 Jul 2023 15:44:11 GMT

Hi @bwn

If you can keep the same security level, use the command

same-security-traffic permit inter-interface

Re: ASA5506 Access Question

MHM Cisco World — Fri, 28 Jul 2023 15:45:07 GMT

1- icmp inspection

2-allow icmp via inside acl if found

3- route OUT 0.0.0.0 0.0.0.0 must add to asa

Re: ASA5506 Access Question

bwn — Fri, 28 Jul 2023 15:56:54 GMT

I have done that as you can see in the screenshot attached. I've also set the security level the same. If I do a tracert from the outside interface it works fine but when I change to the inside_1 interface it hangs.

Re: ASA5506 Access Question

Rob Ingram — Fri, 28 Jul 2023 17:09:40 GMT

@bwn for ICMP you either need to explictly permit ICMP echo-reply inbound on the outside interface ACL or as @MHM Cisco World mentioned enable ICMP inspection. Enable ICMP inspection using the CLI command fixup protocol icmp

To allow traceroute from inside to outside then you need to permit icmp time-exceeded and unreachable inbound on the outsisde interface ACL. Example https://integratingit.wordpress.com/2018/12/15/allow-icmp-traceroute-through-cisco-asa/

Also change the security level of the outside interface to 0, traffic from a low security level to a high level is denied as default (which is what you want on the outside interface).

Re: ASA5506 Access Question

bwn — Fri, 28 Jul 2023 20:35:01 GMT

I've changed the outside security back to 0. Is this where I should be permitting the ICMP echo reply? Is there anywhere I need to add anything?

Re: ASA5506 Access Question

MHM Cisco World — Fri, 28 Jul 2023 21:04:42 GMT

asa# packet-tracer input inside icmp x.x.x.x 8 0 y.y.y.y detail

x.x.x.x is inside subnet