topic Hi Marvin, ASA1 !interface in Network Security

Routing failed to locate next hop for icmp

mahesh18 — Tue, 12 Mar 2019 04:18:37 GMT

Hi Everyone,

Below is the setup

ASA1----DMZ----SW1----DMZ----ASA2

ASA1# ping 192.168.2.51
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.51, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

ASA1 config

interface Vlan4
nameif DMZ
security-level 45
ip address 192.168.1.171 255.255.255.

/ASA1# sh run route
route DMZ 192.168.2.0 255.255.255.0 192.168.1.174 1

Switch config

interface FastEthernet1/0/3
description Connection To ASA 5510
switchport access vlan 5
switchport mode access
spanning-tree portfast

interface Vlan5
ip address 192.168.2.50 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.171

ASA2 config

interface Ethernet0/1
nameif vlan5
security-level 10
ip address 192.168.2.51 255.255.255.0

sh run route
route vlan4 0.0.0.0 0.0.0.0 192.168.1.171 1

From ASA1 i can ping the IP 192.168.2.50 but not .51

Logs from ASA1

%ASA-6-302020: Built outbound ICMP connection for faddr 192.168.2.51/0 gaddr 192.168.1.171/17688 laddr 192.168.1.171/17688

%ASA-6-302021: Teardown ICMP connection for faddr 192.168.2.51/0 gaddr 192.168.1.171/17688 laddr 192.168.1.171/17688

Logs from ASA2

%ASA-6-302020: Built inbound ICMP connection for faddr 192.168.1.171/17381 gaddr 192.168.2.51/0 laddr 192.168.2.51/0
%ASA-6-110003: Routing failed to locate next hop for icmp from vlan5:192.168.2.51/0 to vlan5:192.168.1.171/0
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.1.171/17381 gaddr 192.168.2.51/0 laddr 192.168.2.51/0

Need to know is this default behaviour?

or can i fix this?

Best Regards

Mahesh

Mahesh,You're only showing us

Marvin Rhoads — Sun, 08 Jun 2014 02:26:01 GMT

Mahesh,

You're only showing us half the relevant information. We'd need to see where each subnet resides and what the interface addresses of both ASAs are.

Generally speaking a given subnet needs to be contiguous.

Hi Marvin, ASA1 !interface

mahesh18 — Sun, 08 Jun 2014 03:01:19 GMT

Hi Marvin,

ASA1

!
interface Vlan3
nameif sales
security-level 50
ip address 10.12.12.1 255.255.255.0
!
interface Vlan4
nameif DMZ
security-level 45
ip address 192.168.1.171 255.255.255.0
!

ASA2

interface Ethernet0/0
nameif vlan4
security-level 45
ip address 192.168.1.173 255.255.255.0
!
interface Ethernet0/1
nameif vlan5
security-level 55
ip address 192.168.2.51 255.255.255.0

So subnet 192.168.1.x reside in both ASAs

Also subnet 192.168.2.x reside in Switch and ASA2.

let me know if you need any other info.

Regards

Mahesh

So your pings from ASA1 to

Marvin Rhoads — Sun, 08 Jun 2014 13:07:58 GMT

So your pings from ASA1 to the VLAN 5 interface of ASA 2 fail with the log message that the routing fails. But pings to the switch's VLAN 5 interface pass.

I suspect the switch has a VLAN 4 interface also - is it 192.168.1.174 (the gateway defined on ASA1)? If so the pings to the switch's VLAN 5 interface do not transit ASA2. Instead the switch itself replies directly to ASA1.

Hi Mahesh,You will not be

syed kazim abbas — Sun, 08 Jun 2014 13:52:26 GMT

Hi Mahesh,

You will not be able to ping the outside IP on the ASA from a host on the inside. Additionally, you cannot ping the inside ip address from a host on the outside. If you are trying to ping another device on the outside from a device on the inside, you can enable stateful icmp inspection.

According to your log,

where u are using highlighted address:

/ASA1# sh run route
route DMZ 192.168.2.0 255.255.255.0 192.168.1.174 1

i think you need to use 192.168.1.173

but as Marvan mention below, you have mysterious configuration on switch also.

Regards,

kazim

"Don't forget to rate, if post helpful"

Hi Marvin,Yes switch has

mahesh18 — Sun, 08 Jun 2014 14:08:55 GMT

Hi Marvin,

Yes switch has vlan 4 int with IP 192.168.1.174.

Switch has gateway IP 192.168.1.171.

From ASA1 i can ping switch SVI 192.168.0.50.

As i am seeing log messages generated in the ASA2 so do u agree ping to IP 192.168.2.51 reaches the ASA2?

Regards

MAhesh

Hi Kazim,i did as per

mahesh18 — Sun, 08 Jun 2014 14:16:47 GMT

Hi Kazim,

i did as per you

ASA1

route DMZ 192.168.2.0 255.255.255.0 192.168.1.173 1

after doing this i can not even ping 192.168.2.50

ping 192.168.2.50
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.50, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
pri/act/ASA1# ping 192.168.2.173
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.173, timeout is 2 seconds:
?????

Regards

MAhesh

ok, send your config,

syed kazim abbas — Sun, 08 Jun 2014 16:38:43 GMT

ok, send your config, especially switch interfaces which are facing ASA on both sides and vlan 4 and 5 as well

regards,

kazim

ASA1interface Ethernet0/3

mahesh18 — Sun, 08 Jun 2014 17:40:52 GMT

ASA1

interface Ethernet0/3
description Connection to Switch
switchport access vlan 4

interface Vlan4
nameif DMZ
security-level 45
ip address 192.168.1.171 255.255.255.0

ASA1# sh run route

route DMZ 192.168.2.0 255.255.255.0 192.168.1.174 1

******************************************************************************************

Switch port connecting to ASA1

interface FastEthernet1/0/1
description Connection To ASA 5505
switchport access vlan 4
switchport mode access
spanning-tree portfast

Switch Ports connecting to ASA2

interface FastEthernet1/0/2
description Connection To ASA 5510 Int Eth0/0
switchport access vlan 4
switchport mode access
spanning-tree portfast
!
interface FastEthernet1/0/3
description Connection To ASA 5510 Int Eth0/1
switchport access vlan 5
switchport mode access
spanning-tree portfast

interface Vlan4
ip address 192.168.1.174 255.255.255.0
!
interface Vlan5
ip address 192.168.2.50 255.255.255.0

default route of switch is points to ASA1

ip route 0.0.0.0 0.0.0.0 192.168.1.171

**********************************************************************************************

ASA2 ports connecting to Switch are below --

interface Ethernet0/0
nameif vlan4
security-level 45
ip address 192.168.1.173 255.255.255.0
!
interface Ethernet0/1
nameif vlan5
security-level 55
ip address 192.168.2.51 255.255.255.0

Default gateway of ASA2 is

sh run route
route vlan4 0.0.0.0 0.0.0.0 192.168.1.171 1

Regards

MAhesh

As already mentioned you will

Marius Gunnerud — Sun, 08 Jun 2014 17:49:27 GMT

As already mentioned you will not be able to ping another interface on the ASA other than the ingress interface, so you will never be able to ping VLAN5 interface on ASA2. It is normal behavior that you will see the failed to locate next hop log message. this is because the ICMP packet reaches ASA2 but ASA2 has security measures in place to prevent pinging across the ASA interfaces.

Please remember to select a correct answer and rate helpful posts

Hi MArius,Thanks for

mahesh18 — Sun, 08 Jun 2014 18:00:42 GMT

Hi MArius,

Thanks for answering the question.

For better understanding the firewalls i work at my home lab on weekends.

So does it mean that if host is behind say inside interface of ASA1 which is 10.0.0.x then that host can not ping anyother interface IP of ASA2?

Even though ASA2 is connected far in the network??

Setup is here

PC--10.0.0.10-------inside---ASA1----DMZ---SW---- DMZ ASA2

From PC i can ping the IP of Vlan 5 on switch 192.168.2.50 but

i can not ping IP 192.168.2.51 of ASA2 interface

So does your answer applies to this also?

Best regards

Mahesh

From PC 10.0.0.10 you will be

Marius Gunnerud — Sun, 08 Jun 2014 18:58:49 GMT

From PC 10.0.0.10 you will be able to ping ASA2 interface connected to the DMZ because that is the ingress interface of the ICMP packet. However if you also have an outside interface on ASA2, the outside interface can not be pinged by PC 10.0.0.10 because it is not the ingress interface of the ICMP packet. If you move PC 10.0.0.10 so that the ICMP packet will ingress the outside interface on ASA2 then you will be able to ping that outside interface but not the DMZ interface...

Hope I explained that well enough?

Please remember to select a correct answer and rate helpful posts

Mahesh,As Marius and Kazim

Marvin Rhoads — Sun, 08 Jun 2014 22:05:42 GMT

Mahesh,

As Marius and Kazim noted, one cannot generally ping an ASA interface other that the one via which the packet was received.

I'd say that's the bottom line root cause of your initial observation. Thus the answer to your question "is this default behavior?" is "yes, it is".

You introduced a good bit of artificial complexity with your single switch configuration having physical connections (Layer 1) VLANS (Layer 2) and IP interfaces (Layer 3) connected physically and logically to ASA2 - as well as with the static route you have on ASA1.

Hi Marvin,I was trying to

mahesh18 — Sun, 08 Jun 2014 22:36:49 GMT

Hi Marvin,

I was trying to understand the Firewall world so i was testing these things at home.This helps me in my job where i work extensively on firewalls.

Now i understand things better after getting replies from you.

Best regards

Mahesh

Hi Marius,You explained me

mahesh18 — Sun, 08 Jun 2014 22:37:38 GMT

Hi Marius,

You explained me very well.

Many thanks

MAhesh