topic Hi Karsten, in Network Security

Ping subinterface ip on asa 9.4

giovannipetroselli — Tue, 12 Mar 2019 07:33:51 GMT

Hi to everyone

I've setting up an Asav 9.4 with two subinterfaces gig0.0.20 and gig0.0.30 in vlan 20 and 30 respectively and in the same security level (100) and with the option permit the traffic flows between interfaces with same security level. The ip of the subif are 20.20.20.254 for the vlan 20 and 30.30.30.254 for the vlan 30. I ve also configured also two pc for testing one in vlan 20 and the other one in vlan 30.now the intravlan routing works great so I can ping without any problems from the pc to the another pc address.I can also ping the gateway address of asa in the same vlan. The only issue is that I can't ping the gateway of the other vlan. So from pc1 in vlan 20 I cannot ping the 30.30.30.254 address?

Why the asa doesn't reply to the echo request?

Is there some configuration that I ve missed?

Thanks

Giovanni

That's how the ASA works

Karsten Iwen — Thu, 31 Mar 2016 18:33:12 GMT

That's how the ASA works without an option to enable that. You can only reach the interface that is nearest to the PC.

Hi Karsten,

giovannipetroselli — Thu, 31 Mar 2016 18:50:35 GMT

Hi Karsten,

thanks for your reply! So you mean that is by design this behaviour?

From your perpesctive is there any reason about this behaviour?

Thanks

Yes it's by design. But I'm

Karsten Iwen — Thu, 31 Mar 2016 21:24:49 GMT

Yes it's by design. But I'm not aware of the reason that it was implemented that way.

Have you tried to permit the

rgbatucan — Thu, 29 Sep 2016 05:47:50 GMT

Have you tried to permit the icmp in sub-interface?

icmp permit any (if_name)