topic Re: Issue with icmp-reply through ASA in Network Security

Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 04:00:49 GMT

Hello,

I'm having trouble getting ICMP replies from outside hosts to my inside hosts. I've spent a few hours looking at other posts with the same issue. Most posts suggest policy map inspection over ACL exceptions. I've tried two methods of policy map inspection without success. I can't figure out what I'm missing. Here's what I've been working on:

ACL Method

access-list icmp-allow extended permit icmp any any

class-map icmp-class-map
match access-list icmp-allow
!
!
policy-map icmp-policy-map
class icmp-class-map
inspect icmp
!
service-policy icmp-policy-map interface inside

Inspection Method

class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global

Debug

With either of these applied, I see the following:

firewall# debug icmp trace
debug icmp trace enabled at level 1
firewall# ping googl.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 142.251.215.228, timeout is 2 seconds:
ICMP echo request from 65.129.24.126 to 142.251.215.228 ID=48558 seq=4567 len=72
ICMP echo reply from 142.251.215.228 to 65.129.24.126 ID=48558 seq=4567 len=68
Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2
?ICMP echo request from 65.129.24.126 to 142.251.215.228 ID=48559 seq=4567 len=72
ICMP echo reply from 142.251.215.228 to 65.129.24.126 ID=48559 seq=4567 len=68
Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2
?ICMP echo request from 65.129.24.126 to 142.251.215.228 ID=48560 seq=4567 len=72
ICMP echo reply from 142.251.215.228 to 65.129.24.126 ID=48560 seq=4567 len=68
Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2
?ICMP echo request from 65.129.24.126 to 142.251.215.228 ID=48561 seq=4567 len=72
ICMP echo reply from 142.251.215.228 to 65.129.24.126 ID=48561 seq=4567 len=68
Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2
?ICMP echo request from 65.129.24.126 to 142.251.215.228 ID=48562 seq=4567 len=72
ICMP echo reply from 142.251.215.228 to 65.129.24.126 ID=48562 seq=4567 len=68
Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2

I can see that my inside host is being properly translated to my outside interface's IP (PAT). It seems like the firewall isn't tracking my ICMP request...

My Inside hosts can access the Internet without issue, I'm just having trouble getting ICMP back through the ASA. I'm using a 5506 running 9.16(4) code.

Thanks in advance!

Re: Issue with icmp-reply through ASA

Marius Gunnerud — Tue, 22 Nov 2022 07:55:50 GMT

Do you by chance have any ICMP access rules? try issuing the command "show run icmp" and/or "show run | in icmp" and see if anything shows up

Re: Issue with icmp-reply through ASA

MHM Cisco World — Tue, 22 Nov 2022 10:00:39 GMT

after config the inspection do you check show running ?

Note:-if you use PKT then you need to delete global_policy and add again with ICMP inspection.
this limitation in PKT

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 14:14:21 GMT

Hello Marius,

Here's the info you asked for:

firewall# show run icmp
icmp unreachable rate-limit 1 burst-size 1
icmp deny any outside
icmp permit any DMZ
icmp permit any inside

From what I've read, the icmp deny and permit statements above are for whether the ASA will respond to ICMP on its interfaces, not whether it'll pass & track ICMP.

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 14:16:31 GMT

Hello MHM,

I don't understand "use PKT". I have removed and recreated the global_polcy policy-map a few times while switching back and forth between inspection methods. Pulling out the policy-map code and re-applying it during trouble-shooting should have effectively done what you've suggested.

Re: Issue with icmp-reply through ASA

MHM Cisco World — Tue, 22 Nov 2022 14:23:19 GMT

PKT packet-tracer.
if you do all above you mention, can you share
show access-list

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 16:39:07 GMT

I thought I'd add a network diagram too to help visualized the environment.

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 16:58:12 GMT

Hello MHM,

I've tried maybe six times to post my config in my reply but the forum site keeps dropping my post. I've attached my running config. Note that I've removed all the policy-map icmp inspect code.

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 18:09:52 GMT

I'm adding ASDM screenshots of my interfaces, firewall rules, and nat configuration. Sometimes it's easier to see the data in the GUI vs CLI.

Re: Issue with icmp-reply through ASA

MHM Cisco World — Tue, 22 Nov 2022 18:32:37 GMT

I will run lab now and update you.

Re: Issue with icmp-reply through ASA

MHM Cisco World — Tue, 22 Nov 2022 23:36:26 GMT

thanks for sharing. I apply same config
BVI and inspect ICMP and all fine except
are you using inside interface as source of ping ??

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 23:37:30 GMT

Hello MHM,

I just got home and tried implementing the policy-map using ASDM. It worked. The code I created by hand via CLI is EXACTLY the same as the code created by ASDM. I don't have a good reason why the new code is working but it is. Thanks for your help.

ASDM created code

class-map global-class
description Permit ICMP return traffic
match default-inspection-traffic
!
!
policy-map global-policy
description Permit ICMP return traffic
class global-class
inspect icmp
!
service-policy global-policy global

CLI created code

class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global

Re: Issue with icmp-reply through ASA

MHM Cisco World — Tue, 22 Nov 2022 23:44:57 GMT

Yes I do lab and also success to ping from host inside to host outside using same policy you share.

Anyway

I So glad your issue solved.

Re: Issue with icmp-reply through ASA

robertramsey — Tue, 22 Nov 2022 23:54:29 GMT

Hello MCM,

I'm pinging out from a Windows 10 host within my inside network. That's the way I've tested throughout my trouble-shooting.

Re: Issue with icmp-reply through ASA

MHM Cisco World — Wed, 23 Nov 2022 00:11:32 GMT

you test windows but the IP use for windows is it same as ASA inside interface?
why I ask you that, because when I run lab I run debug icmp and ping from inside interface and I get exactly same as your issue

Denied ICMP type = 0, code = 0 from 142.251.215.228on interface 2

Re: Issue with icmp-reply through ASA

robertramsey — Wed, 23 Nov 2022 00:21:04 GMT

Hell MHM,

I'm testing that now... When I ping google.com from the ASA it fails, like before, but from an inside PC it works... Looking at my original post, I tested by pinging from the ASA and it failed. I want to believe I always tested using my PC but maybe not... So, different question then, why can't I get ICMP reply when pinging from the ASA? Nice catch by the way!

From ASA

firewall# ping google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 142.251.211.238, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
firewall#

From PC

C:\Users\ramse>ping google.com

Pinging google.com [142.251.211.238] with 32 bytes of data:
Reply from 142.251.211.238: bytes=32 time=13ms TTL=118
Reply from 142.251.211.238: bytes=32 time=13ms TTL=118
Reply from 142.251.211.238: bytes=32 time=13ms TTL=118
Reply from 142.251.211.238: bytes=32 time=13ms TTL=118

Ping statistics for 142.251.211.238:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 13ms, Maximum = 13ms, Average = 13ms

C:\Users\ramse>

Re: Issue with icmp-reply through ASA

MHM Cisco World — Wed, 23 Nov 2022 13:48:21 GMT

ASA by default not accept the ping toward it interface.
I make lab yesterday and I success make interface accept ping toward it BUT I dont recommend change the default behave of ASA.
what I add is one command
icmp permit host < > echo-reply <IN interface>

Re: Issue with icmp-reply through ASA

robertramsey — Wed, 23 Nov 2022 14:46:49 GMT

Hello MHM,

I've been thinking about ICMP flow when initiated from the ASA. Most Cisco devices, probably the ASA too, will use the nearest interface to the destination when originating traffic, including ICMP requests. Therefor, the ASA is probably sourcing the ICMP request from the outside interface but it's not configured to track that interface's ICMP traffic. Moreover, I have an explicit ICMP deny statement configured for the outside interface, which is the destination of the ICMP reply.

I think I just got confused when I switched from my host to the ASA when performing my ping tests. It's been super educational and interesting but a journey started by an inconsistent test method.

Thanks for all your help. You really have been an ambassador of good will throughout this process.

Re: Issue with icmp-reply through ASA

JaySL — Thu, 05 Sep 2024 11:47:09 GMT

This is very strange but it works. Do we have to do this again and again even in the new image versions?