Ping to FTD interface

Moon1998 — Fri, 01 Nov 2019 10:24:02 GMT

Hi guys,

I am having issues pinging my FTD internal interfaces. I can actually ping WAN interface, no issue there. But for LAN interface packet tracer says "no route". I can ping the hosts inside the LAN. There are no specific ICMP rules in Device Platform Policy on FMC. Any suggestions?

10.50.31.97/27 is my LAN interface.

Trace to host inside LAN:

> packet-tracer input WAN icmp 10.11.28.169 0 0 10.50.31.97

Result:
input-interface: WAN
input-status: up
input-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

> packet-tracer input WAN icmp 10.11.28.169 0 0 10.50.31.98

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 10.50.31.98 using egress ifc LAN

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
..etc

Trace to WAN interface:

> packet-tracer input WAN icmp 10.11.28.169 0 0 10.11.39.106

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 10.11.39.106 using egress ifc identity

..etc

Thanks.

Re: Ping to FTD interface

Rob Ingram — Fri, 01 Nov 2019 10:40:06 GMT

Hi,
That is to be expected. An FTD/ASA only responds to ICMP traffic sent to the interface that traffic comes in on. So you cannot ping from the WAN interface through the firewall to LAN interface, that's by design.

HTH

Re: Ping to FTD interface

Moon1998 — Fri, 01 Nov 2019 10:45:13 GMT

Ah, missed that 😉

Thanks!

topic Ping to FTD interface in Network Security

Ping to FTD interface

Re: Ping to FTD interface

Re: Ping to FTD interface