topic Is there by chance a firewall in Network Security

Asa 5510 - additional outside /27 address block. No icmp into it.

DjDamo — Tue, 12 Mar 2019 04:01:33 GMT

Hi all.... hoping an easy answer to this one. I have seen a few views that don't help me. I have just migrated a Watchguard X seres to an Asa 5510. I have a 2811 in front of it to handle the Bgp peering previously handled by the WG. All is well. There are several public facing services behind the Asa hence the additional /27. The ouside interface of the Asa is one half of another /30. I defined all the /27 ddresses as objects and used them ok in access and nat rules. The public services are ok and I can get out to the internet from Dmz and Inside networks.

I have just realised that my externally hosted monitoring service that polls (pings mostly) the public servers (the servers responding to the /27 addresses) isn't working. I cant ping any of the /27 addresses from outside. I can ping the outside interface /30 address. There is an access-l rule any any for icmp - in on the outside interface.

I am missing something simple right?

Cheers

Damien.

Is there by chance a firewall

jj27 — Wed, 02 Apr 2014 18:14:02 GMT

Is there by chance a firewall on your internal resources that are natted to the public IPs that would prevent ICMP?

DamienAnother possible cause

Jon Marshall — Wed, 02 Apr 2014 19:34:39 GMT

Damien

Another possible cause is if you have an acl applied to the inside interface that might be blocking the return ICMP packets.

If you are using ICMP inspection you should be fine but if not you would need to modify the inside acl.

Jon

Jon, no Acls on inside

DjDamo — Thu, 03 Apr 2014 02:55:20 GMT

Jon, no Acls on inside interface. But the issue unrelated to the inside. I cant ping these public addreses from the internet. Yet I can ping the xternal interface /30 address from the internet ok. I can also get to the natted services that are using the /27 addresses, just no icmp! There is an any-any in rule on outside for icmp.

I am thinking the way I have used the /27 addresses must be incorrect. Struggling to find any doco though.

Damien.

No.... some more detail in

DjDamo — Thu, 03 Apr 2014 02:56:46 GMT

No.... some more detail in response above. The issue is icmp to the /27 public addresses from the internet. Can get to any natted service just no icmp.