topic Hello Karsten,Thanks a lot. I in Network Security

Why can't the inside interface with a higher security level on ASA 5545 ping the DMZ interface with a lower security level

Joseph Oloyede — Tue, 12 Mar 2019 04:39:37 GMT

Why can't the inside interface with a higher security level on ASA 5545 ping the DMZ interface with a lower security level. No NAT is configured. I expect by default, i should be able to ping a lower security level from an higher security level interface on the ASA.

If there is no ACL applied to

Karsten Iwen — Thu, 21 Aug 2014 11:30:09 GMT

If there is no ACL applied to the higher interface that denies the traffic, then the higher security-system can ping the system on the lower level. But with the ASA-defaults, ICMP is not stateful and the replies are dropped. To make it staeful you have to extend your default policy-map:

policy-map global_policy class inspection_default inspect icmp

Hello Karsten,Thanks for the

Joseph Oloyede — Thu, 21 Aug 2014 11:57:36 GMT

Hello Karsten,

Thanks for the reply, have included the command, but still cannot ping the lower interface.

What are you trying exactly?

Karsten Iwen — Thu, 21 Aug 2014 12:31:01 GMT

What are you trying exactly? Ping a system on the lower security-level or the lower security-level ASA-interface? The later is not supported on the ASA. Then test it with a ping to a system in the DMZ.

Hello Karsten,Thanks a lot. I

Joseph Oloyede — Thu, 21 Aug 2014 12:43:41 GMT

Hello Karsten,

Thanks a lot. I was pinging the lower security level on the ASA-interface. I can ping a system in the DMZ now.