topic Hi Marvin, PC has default in Network Security

Unable to ping loopback IP of switch From PC connected to ASA Inside interface

mahesh18 — Tue, 12 Mar 2019 04:14:39 GMT

Hi Everyone,

Here is setup

Switch -------------------------ASA1----Active

ASA1----Standby

ASA is config as Active/Standby

ASA has dhcp config that provides PC with IP 10.0.0.11

From Switch i can ping my PC

1#ping 10.0.0.11

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/9 ms

Switch info
1#sh ip int brief
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  10.0.0.4        YES NVRAM up                    up
FastEthernet1/0/1      unassigned      YES unset up                    up
FastEthernet1/0/2      unassigned      YES unset up                    up
FastEthernet1/0/3      unassigned      YES unset down                  down
FastEthernet1/0/4      unassigned      YES unset down                  down
FastEthernet1/0/5      unassigned      YES unset down                  down
FastEthernet1/0/6      unassigned      YES unset down                  down
FastEthernet1/0/7      unassigned      YES unset down                  down
FastEthernet1/0/8      unassigned      YES unset down                  down
FastEthernet1/0/9      unassigned      YES unset down                  down
FastEthernet1/0/10     unassigned      YES unset down                  down
FastEthernet1/0/11     unassigned      YES unset down                  down
FastEthernet1/0/12     unassigned      YES unset down                  down
FastEthernet1/0/13     unassigned      YES unset down                  down
FastEthernet1/0/14     unassigned      YES unset down                  down
FastEthernet1/0/15     unassigned      YES unset down                  down
FastEthernet1/0/16     unassigned      YES unset down                  down
FastEthernet1/0/17     unassigned      YES unset down                  down
FastEthernet1/0/18     unassigned      YES unset down                  down
FastEthernet1/0/19     unassigned      YES unset down                  down
FastEthernet1/0/20     unassigned      YES unset down                  down
FastEthernet1/0/21     unassigned      YES unset down                  down
FastEthernet1/0/22     unassigned      YES unset down                  down
FastEthernet1/0/23     unassigned      YES unset down                  down
FastEthernet1/0/24     unassigned      YES unset down                  down
GigabitEthernet1/0/1   unassigned      YES unset administratively down down
GigabitEthernet1/0/2   unassigned      YES unset administratively down down
Loopback0              10.1.0.1        YES NVRAM up                    up
Loopback1              10.1.1.1        YES NVRAM up                    up
Loopback2              10.1.2.1        YES NVRAM up                    up
Loopback3              10.1.3.1        YES NVRAM up                    up
Loopback4              10.1.4.1        YES NVRAM up                    up
Loopback5              10.1.5.1        YES NVRAM up                    up
Loopback6              10.1.6.1        YES NVRAM up                    up
Loopback7              192.168.50.1    YES NVRAM up                    up
Loopback8              unassigned      YES NVRAM up                    up
R1#

ASA has Vlan 1 as inside interface with IP 10.0.0.1 and has direct connection to switch on vlan 1.

From ASA i can ping the 10.1.0.1

ASA1# ping 10.1.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

From PC i can not ping IP 10.1.0.1

Logs from ASA

May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

ASA info

ASA1# sh int
ASA1# sh interface ip brief
Interface                  IP-Address      OK? Method Status                Protocol
Ethernet0/0                unassigned      YES unset up                    up
Ethernet0/1                unassigned      YES unset up                    up
Ethernet0/2                unassigned      YES unset up                    up
Ethernet0/3                unassigned      YES unset down                  down
Ethernet0/4                unassigned      YES unset up                    up
Ethernet0/5                unassigned      YES unset up                    up
Ethernet0/6                unassigned      YES unset administratively down down
Ethernet0/7                unassigned      YES unset administratively down down
Internal-Data0/0           unassigned      YES unset up                    up
Internal-Data0/1           unassigned      YES unset up                    up
Vlan1                      10.0.0.1        YES CONFIG up                    up
Vlan2                      96.x.x.x.   YES manual up                    up
Vlan3                      10.12.12.1      YES CONFIG up                    up
Vlan30                     10.30.30.1      YES unset up                    up
Virtual0                   127.1.0.1       YES unset up                    up

Need to know why this ping is not working is this due to NAT also why ASA is looking for loopback IP of switch in outside direction?

Regards

MAhesh

Hi Mahesh,what's your netmask

Patrick Moubarak — Mon, 26 May 2014 18:18:52 GMT

Hi Mahesh,

what's your netmask on VLAN1?

you can try from the switch ping 10.0.0.11 source Lo0; does that work?

also please attach show route on ASA and switch (if it is a layer 3 switch)...

Patrick

Hi Patrick,Vlan1 has netmask

mahesh18 — Mon, 26 May 2014 18:26:47 GMT

Hi Patrick,

Vlan1 has netmask 255.255.255.0

1#ping 10.0.0.14 source loopback 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.14, timeout is 2 seconds:
Packet sent with a source address of 10.1.0.1
.....
Success rate is 0 percent (0/5)

Above is ping from Switch to PC IP

Switch is layer 3

1#sh int vlan1
Vlan1 is up, line protocol is up
Hardware is EtherSVI, address is 0011.bb5e.e240 (bia 0011.bb5e.e240)
Internet address is 10.0.0.4/24

Route info

1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 8 subnets
C       10.1.3.0 is directly connected, Loopback3
C       10.1.2.0 is directly connected, Loopback2
C       10.1.1.0 is directly connected, Loopback1
C       10.0.0.0 is directly connected, Vlan1
C       10.1.0.0 is directly connected, Loopback0
C       10.1.6.0 is directly connected, Loopback6
C       10.1.5.0 is directly connected, Loopback5
C       10.1.4.0 is directly connected, Loopback4
C    192.168.50.0/24 is directly connected, Loopback7
S*   0.0.0.0/0 [1/0] via 10.0.0.1

ASA1# sh run route
route outside 0.0.0.0 0.0.0.0 96.51.148.1 1
route inside 10.1.0.0 255.255.0.0 10.0.0.4 1
route inside 192.168.50.0 255.255.255.0 10.0.0.4 1

Regards

Mahesh

Mahesh,What's the default

Marvin Rhoads — Mon, 26 May 2014 20:19:28 GMT

Mahesh,

What's the default gateway for the PC? ("route print" from command prompt if it's a Windows host)

If it's not 10.0.0.1 on the ASA then your ping will fail.

Hi Marvin, PC has default

mahesh18 — Mon, 26 May 2014 20:24:01 GMT

Hi Marvin,

PC has default gateway of 10.0.0.1

C:\Users\manveer>route print
===========================================================================
Interface List
25...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter #2
23...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter
21...74 e5 0b 5b e7 88 ......Intel(R) WiFi Link 1000 BGN
13...f0 bf 97 de 4f 48 ......Atheros AR8151 PCI-E Gigabit Ethernet Controller (
NDIS 6.20)
12...94 39 e5 97 60 b5 ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface Metric
          0.0.0.0          0.0.0.0         10.0.0.1        10.0.0.14     25
         10.0.0.0    255.255.255.0         On-link         10.0.0.14    281
        10.0.0.14 255.255.255.255         On-link         10.0.0.14    281
       10.0.0.255 255.255.255.255         On-link         10.0.0.14    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1 255.255.255.255         On-link         127.0.0.1    306
127.255.255.255 255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.0.0.14    281
255.255.255.255 255.255.255.255         On-link         127.0.0.1    306
255.255.255.255 255.255.255.255         On-link         10.0.0.14    281
===========================================================================
Persistent Routes:
Network Address          Netmask Gateway Address Metric
          0.0.0.0          0.0.0.0     192.168.98.1 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination      Gateway
1    306 ::1/128                  On-link
21    281 fe80::/64                On-link
21    281 fe80::f54f:db1d:f86:1184/128
                                    On-link
1    306 ff00::/8                 On-link
21    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
None

C:\Users\manveer>ipconfig

Windows IP Configuration

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix . :
   Link-local IPv6 Address . . . . . : fe80::f54f:db1d:f86:1184%21
   IPv4 Address. . . . . . . . . . . : 10.0.0.14
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.0.1

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Regards

Mahesh

try removing the persistent

Patrick Moubarak — Mon, 26 May 2014 20:40:40 GMT

try removing the persistent default route:

Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.98.1 Default

Delete the persistent route

mahesh18 — Mon, 26 May 2014 21:29:49 GMT

Delete the persistent route and did ping to 10.1.0.1 still same thing.

Logs from ASA

May 26 2014 15:15:08: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1

May 26 2014 15:15:10: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1

I think you are getting

Marvin Rhoads — Mon, 26 May 2014 23:52:06 GMT

I think you are getting asymmetric routing since the switch is the same place your PC is attached.

Your PC pings an address on the 10.1.0.0 network. It sends it to the ASA (default gateway). ASA has a static route to that network so it sends the packet back to the switch. The switch receives the echo request and then creates a reply to the PC. At this point I believe the reply does not go via the ASA but instead tries and fails to go back to the PC via the switch's 10.0.0.4 address since a connected route takes priority over a static route (given the same prefix).

Try adding a static route in the switch to your PC address:

route 10.0.0.14 255.255.255.255 10.0.0.1

That should force the return traffic via the ASA. Make sure you have "same-security-traffic intra-interface" enabled on the ASA.

I config static route on

mahesh18 — Tue, 27 May 2014 00:19:30 GMT

I config static route on switch

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
S       10.0.0.14/32 [1/0] via 10.0.0.1
C       10.1.3.0/24 is directly connected, Loopback3
C       10.1.2.0/24 is directly connected, Loopback2
C       10.1.1.0/24 is directly connected, Loopback1
C       10.0.0.0/24 is directly connected, Vlan1
C       10.1.0.0/24 is directly connected, Loopback0
C       10.1.6.0/24 is directly connected, Loopback6
C       10.1.5.0/24 is directly connected, Loopback5
C       10.1.4.0/24 is directly connected, Loopback4
C    192.168.50.0/24 is directly connected, Loopback7
S*   0.0.0.0/0 [1/0] via 10.0.0.1

ASA is configured for same-security-traffic.

Still same thing.

After adding route to switch i can not ping or telnet to switch IP 10.0.0.4 from

my pc.

I agree with Marvin that this

Marius Gunnerud — Tue, 27 May 2014 12:13:51 GMT

I agree with Marvin that this seems to be an asynchronous routing issue. I do not think adding a static route will help, as connected routes will take precedence over the static route, and you will still have the same asynchronous routing issue.

Trying issuing a packet capture on the ASA for both the ingress and egress interfaces. This should clear up if the return packets are reaching the ASA or not. Post the output here if you require assistance with reading it.

Please remember to select a correct answer and rate

Hi MArius, I config packet

mahesh18 — Tue, 27 May 2014 12:49:50 GMT

Hi MArius,

I config packet capture on inside interface

here is output

ASA1# sh capture capin

4 packets captured

After this i also config packet capture for outside interface

capture capin interface outside match ip host 10.0.0.18 host 10.1.0.1

ASA1# sh capture capin

12 packets captured

   1: 06:44:46.747169       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   2: 06:44:51.627378       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   3: 06:44:56.635724       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   4: 06:45:01.641995       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   5: 06:46:03.760153       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   6: 06:46:03.760489       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   7: 06:46:08.639340       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   8: 06:46:08.639676       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   9: 06:46:13.636380       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
10: 06:46:13.636716       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
11: 06:46:18.627775       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
12: 06:46:18.628126       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request

What does the above packet capture show?

Regards

MAhesh

This confirms Marvins, and

Marius Gunnerud — Tue, 27 May 2014 13:09:54 GMT

This confirms Marvins, and mine, theory that the ASA never sees the return packet from the switch. Then when the PC sends another ICMP packet, the ASA sees that the packet is out of order and drops it as a spoofed packet.

You could configure the ASA for TCP bypass, but it is not a recommended solution and if you do not have a direct requirement to be able to ping or reach the loopback you should not implement it.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html

Please remember to select a correct answer and rate

Hi Marius, I am trying to

mahesh18 — Tue, 27 May 2014 14:58:03 GMT

Hi Marius,

I am trying to understand the packet flow from PC to switch loopback.

Seems as per logs ASA is looking for Switch loopback IP in outside direction right?

May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

So ASA is sending packet in outside direction instead of inside right?

As there is no host on outside connection thats the reason ping is not working?

Regards

MAhesh

It looks like the issue is

Patrick Moubarak — Tue, 27 May 2014 17:02:29 GMT

It looks like the issue is that PC, switch and ASA are in the same network (10.0.0.0/24)

As far as I know, ASA does not send ICMP redirect messages; you can add a static route on the PC for the network 10.1.0.0 to go directly to switch instead of ASA; that will solve the issue for that PC only.

I think the best practice is to create a routing subnet between the switch and ASA:

PC - SWITCH in VLAN1

SWITCH - ASA in a new VLAN used for routing

that means you have to make the switch your default gateway for VLAN1 and change the IP of the inside interface of the ASA + change the routes...

check this link to understand ICMP redirects:

http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html

other forum posts discuss the same issue:

https://supportforums.cisco.com/discussion/11229301/icmp-redirect

Patrick

OK, I just set this up in

Marius Gunnerud — Wed, 28 May 2014 07:45:15 GMT

OK, I just set this up in GNS3 and got it to work...however I was using a router instead of a PC to ping from.

But I assume that since you can ping your PC from the switch the PC's local firewall isn't blocking ICMP packets.

Have you done a debug on the ICMP packets on the switch to see if there might be something there that is blocking it?

Do you perhaps have an ACL on the ASA inside interface...or on the switch for that matter...that could be blocking the ICMP traffic?

but to answer your questions:

So ASA is sending packet in outside direction instead of inside right?

No, the packet goes from the PC to the ASA, from the ASA to the switch, then from the switch directly back to the PC.

Please remember to select a correct answer and rate

Hi MAricus,I enabled debug

mahesh18 — Wed, 28 May 2014 14:00:30 GMT

Hi MAricus,

I enabled debug ip icmp on switch and did the ping.

No output was seen on switch.

There is no ACL on switch.

Regards

Mahesh

HiIs there an ACL on the ASA

Marius Gunnerud — Wed, 28 May 2014 14:04:28 GMT

Is there an ACL on the ASA inside interface that?

could you please provide the ASA and switch configs (sanitised)?

Please remember to select a correct answer and rate

Hi Patrick,when i assigned

mahesh18 — Wed, 28 May 2014 14:08:54 GMT

Hi Patrick,

when i assigned static route to PC as you said then ping worked fine.

If you can explain me how traffic flows from PC to Switch ?

Learned something new today.Will read about ICMP redirects and will have better understanding then.

Best Regards

MAhesh

The reason patricks

Marius Gunnerud — Wed, 28 May 2014 14:40:16 GMT

The reason patricks suggestion worked is because the switch is also doing routing. So in this case the ping never goes through the firewall but instead directly between the pc and switch. -- Please remember to select a correct answer and rate

Hi Everyone, Thanks to

mahesh18 — Wed, 28 May 2014 15:03:23 GMT

Hi Everyone,

Thanks to everyone for replying on this post.

Best Regards

MAhesh