Could not ping inside Host from Internet

man3mar3n — Tue, 12 Mar 2019 07:03:43 GMT

Hi,

I need to ping host 211.25.206.253 from Internet. The IP is a nat from a inside IP 10.200.200.5. I attached the config. I read through some of the same problem in the forum, but it just not working. Please help to isolate the problem.

!
interface Ethernet0/0
nameif outside
security-level 0
ip address 211.25.206.180 255.255.255.128
!
interface Ethernet0/1
nameif DMZ
security-level 100
ip address 10.208.228.1 255.255.0.0
!
interface Ethernet0/2
nameif inside15
security-level 100
ip address 172.15.1.1 255.255.255.0
!
interface Ethernet0/3
nameif inside16
security-level 100
ip address 172.16.1.1 255.255.255.0

ftp mode passive
object network OBJ-NET-DMZ-ASTERISK-TEST
host 10.200.200.5
object network OBJ-NET-DMZ-TEST
subnet 10.208.0.0 255.255.0.0
object network OBJ-NET-INSIDE15-TEST
subnet 172.15.1.0 255.255.255.0
object network OBJ-NET-INSIDE16-TEST
subnet 172.16.1.0 255.255.255.0
access-list ACL-OUT2IN extended permit ip any object OBJ-NET-DMZ-ASTERISK-TEST
access-list ACL-OUT2IN extended permit ip any object OBJ-NET-DMZ-TEST
access-list ACL-OUT2IN extended permit ip any object OBJ-NET-INSIDE15-TEST
access-list ACL-OUT2IN extended permit ip any object OBJ-NET-INSIDE16-TEST
access-list ACL-OUT2IN extended permit icmp any any echo-reply
access-list ACL-OUT2IN extended permit tcp any object OBJ-NET-DMZ-ASTERISK-TEST eq ftp
access-list ACL-OUT2IN extended permit tcp any object OBJ-NET-DMZ-ASTERISK-TEST eq ftp-data
access-list SPLIT_TUNNEL standard permit 172.15.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu DMZ 1500
mtu inside15 1500
mtu inside16 1500
ip local pool VPN-POOL-TEST 172.15.1.10-172.15.1.50 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network OBJ-NET-DMZ-ASTERISK-TEST
nat (DMZ,outside) static 211.25.206.253
object network OBJ-NET-DMZ-TEST
nat (DMZ,outside) dynamic interface
object network OBJ-NET-INSIDE15-TEST
nat (inside15,outside) dynamic interface
object network OBJ-NET-INSIDE16-TEST
nat (inside16,outside) dynamic interface
access-group ACL-OUT2IN in interface outside
route outside 0.0.0.0 0.0.0.0 211.25.206.129 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set VPN-TSET-TEST esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set VPN-TSET-TEST
crypto map vpn 20 ipsec-isakmp dynamic outside_dyn_map
crypto map vpn interface outside
crypto isakmp identity address
crypto ikev1 enable outside
crypto ikev1 policy 20
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 86400
!
dhcpd address 10.208.228.10-10.208.228.200 DMZ
dhcpd enable DMZ
!
dhcpd address 172.15.1.10-172.15.1.200 inside15
dhcpd enable inside15
!
dhcpd address 172.16.1.10-172.16.1.200 inside16
dhcpd enable inside16
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy VPN-GRP-TEST internal
group-policy VPN-GRP-TEST attributes
dns-server value 8.8.8.8 8.8.4.4
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT_TUNNEL
default-domain value VPN-TEST
split-dns value VPN-TEST
username user1 password 9YnT4ov0VJRr86pn encrypted
tunnel-group VPN-GRP-TEST type remote-access
tunnel-group VPN-GRP-TEST general-attributes
address-pool VPN-POOL-TEST
default-group-policy VPN-GRP-TEST
tunnel-group VPN-GRP-TEST ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily

In your configuration you

Rishabh Seth — Tue, 22 Dec 2015 19:50:31 GMT

In your configuration you have permitted ip any to the host on DMZ:

access-list ACL-OUT2IN extended permit ip any object OBJ-NET-DMZ-ASTERISK-TEST

With this configuration and icmp inspection in place you should be able to ping, but if it is not working then you can try couple of things:

>> Check if you can ping the host 10.200.200.5 from ASA.

>> Run packet-tracer and see how ASA is processing the traffic.

packet-tracer input outside icmp <anyip> 8 0 <public ip of host>

>> if there is no issue seen in packet-trace then try

#debug icmp trace

#term mon

and run the icmp, you should debugs on screen for icmp packets.

+ disable debugs: undebug all

Thanks,

R.S.

Hi,

man3mar3n — Wed, 23 Dec 2015 09:08:45 GMT

Hi,

I found the problem. It is the PC firewall which is preventing the ping from going thru.

Thanks all for help

topic Could not ping inside Host from Internet in Network Security

Could not ping inside Host from Internet

In your configuration you

Hi,