topic Deny ping on outside interface while allowing inside hosts to ping external hosts in Network Security

Deny ping on outside interface while allowing inside hosts to ping external hosts

scotteberl — Tue, 12 Mar 2019 05:07:01 GMT

Been wresting with this one for a bit not.

Running IOS 9.2 on a ASA5505

Can anyone tell me how I could accomplish this? I know how to disable ping on the outside interface using icmp deny any outside but then when I try to ping an external ip the replies seem to never come back.

Denying ICMP packets

ghostinthenet — Fri, 21 Nov 2014 02:46:26 GMT

Denying ICMP packets wholesale isn't a practice I recommend, only because you're disabling essential control packets along with ping requests. Instead of turning it off with "icmp deny any outside", try putting something like "deny icmp any any echo" in the ACL for your outside interface. This will prevent external ping traffic, but allow other ICMP to pass... including replies to ping requests generated by internal devices.

Thanks for the reply Jody. I

scotteberl — Fri, 21 Nov 2014 03:44:29 GMT

Thanks for the reply Jody. I ended up getting it working using the following configuration items:

icmp permit any echo-reply OUTSIDE
icmp deny any echo OUTSIDE

That will work, too.Also, it

ghostinthenet — Fri, 21 Nov 2014 05:56:26 GMT

That will work, too.

Also, it's best to make sure you're permitting all of the other ICMP types other than echo so that you don't lose control functions like path mtu discovery, network unreachable, traceroute, &c.

So you don't see allowing

scotteberl — Fri, 21 Nov 2014 21:34:50 GMT

So you don't see allowing ping to the outside interface of the ASA as a security concern?

Personally, no... but that's

ghostinthenet — Fri, 21 Nov 2014 22:28:08 GMT

Personally, no... but that's up to you.

What I'm saying is that even if you are blocking pings to your ASA, you should make sure that other ICMP traffic is permitted in. These are used for various Internet control functions and you're potentially limiting functionality and troubleshooting capabilities by blocking them.