ASA cannot ping internal subinterfaces (DMZs)

Oscar Bonilla — Tue, 12 Mar 2019 05:19:18 GMT

Hello everyone,

I have some questions regarding internal interfaces on the Cisco ASA.

I have a CISCO 5555-X running version 9.1(3) and a pretty simple configuration. I have an INSIDE and a DMZ, both of them are port-channels but DMZ is working as sub-interfaces.

Hosts on the DMZ are able to reach all the hosts on the INSIDE and vice versa, I haven´t restricted any traffic yet.But if a host from the INSIDE tries to ping a sub-interface on the ASA (DMZ default-gateway) it gets no response. Even if I ping from the INSIDE interface itself to a DMZ sub-interface I still get no response.

INSIDE: 192.168.254.26

DMZ sub: 13.1.1.1

ASA/pri/act# packet-trace input inside icmp 192.168.254.26 8 0 13.1.1.1

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 13.1.1.1 255.255.255.255 identity

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 13.1.1.1 255.255.255.255 identity

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

Is this an expected behavior?

Any help will be highly appreciated.

THANKS!

That's as expected.You can

Marvin Rhoads — Sat, 10 Jan 2015 00:07:59 GMT

That's as expected.

You can only ping an ASA interface (assuming it's been allowed) from a host downstream of that interface. Also, you can not ping one ASA interface from another one.

In either case, when talking to an interface directly, the traffic needs to come from a network that's connected to or downstream from that interface.

Thank you Marvin, That´s

Oscar Bonilla — Mon, 12 Jan 2015 15:55:39 GMT

Thank you Marvin,

That´s exactly what I needed to know.

Have a great week!

topic ASA cannot ping internal subinterfaces (DMZs) in Network Security

ASA cannot ping internal subinterfaces (DMZs)

That's as expected.You can

Thank you Marvin, That´s