topic From Inside host unable to ping the ASA inside interface in Network Security

From Inside host unable to ping the ASA inside interface

mahesh18 — Tue, 12 Mar 2019 00:24:54 GMT

Hi Everyone,

ASA inside interface has connection to switch.

ASA inside interface IP 192.168.1.1.

Switch Vlan 1 IP 192.168.1.2

Host PC connected to switch IP 192.168.1.5

questions

From host PC i can ping the internet but not IP 192.168.1.1?

Also from switch i can not ping 192.168.1.1 ?

is above issues is due to ASA design or i am missing comething in my config?

Thanks

MAhesh

From Inside host unable to ping the ASA inside interface

cadet alain — Mon, 19 Nov 2012 14:24:11 GMT

Hi,

it should be working by default, can you post your config.

Regards.

Alain

Don't forget to rate helpful posts.

From Inside host unable to ping the ASA inside interface

mahesh18 — Tue, 20 Nov 2012 18:33:18 GMT

Hi Alain,

Thanks for reply.

Currently i am away from ASA.

I will past the config today evening.

Thanks

Mahesh

From Inside host unable to ping the ASA inside interface

lcambron — Wed, 21 Nov 2012 01:55:53 GMT

Mahesh,

With the configuration of the ASA and the switch port connecting to the ASA we should be able to help.

Also, clear the arp on the firewall, try to ping the switch and check if the ASA has an arp entry for 192.168.1.2

Regards,

Felipe.

From Inside host unable to ping the ASA inside interface

mahesh18 — Wed, 21 Nov 2012 02:27:28 GMT

Hi Alain and Felipe,

Here is config of ASA

ciscoasa# sh running-config

: Saved

ASA Version 8.2(5)

hostname ciscoasa

enable password PnBz02JMnfQN7Ggt encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 192.168.1.9 Mintoo

interface Ethernet0/0

description Connection to Outside Int fa0/3 of 3550B

switchport access vlan 2

interface Ethernet0/1

description Connection to Inside Int fa0/1 of 3550Inside

interface Ethernet0/2

description Connection to DMZ Int fa0/40 of 3550DMZ

switchport access vlan 3

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

description INSIDE to 3550Inside

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface Vlan2

description OUTSIDE to 3550B

nameif outside

security-level 0

ip address 192.168.11.2 255.255.255.0

interface Vlan3

description DMZ to 3550DMZ

no forward interface Vlan1

nameif DMZ

security-level 50

ip address 192.168.12.2 255.255.255.0

banner motd

banner motd +-+

banner motd | |

banner motd | *** Unauthorized Use or Access Prohibited *** |

banner motd | |

banner motd | For Authorized Official Use Only |

banner motd | You must have explicit permission to access or |

banner motd | configure this device. All activities performed |

banner motd | on this device may be logged, and violations of |

banner motd | this policy may result in disciplinary action, and |

banner motd | may be reported to law enforcement authorities. |

banner motd | |

banner motd | There is no right to privacy on this device. |

banner motd | |

banner motd +-+

banner motd

banner motd +-+

banner motd | |

boot system disk0:/asa825-k8.bin

ftp mode passive

clock timezone MST -7

clock summer-time MST recurring

access-list OUTSIDE_IN extended permit tcp host 192.168.11.1 host 192.168.12.1 eq telnet

pager lines 24

logging enable

logging timestamp

logging buffered informational

mtu inside 1500

mtu outside 1500

mtu DMZ 1500

icmp unreachable rate-limit 1 burst-size 1

icmp deny any inside

no asdm history enable

arp timeout 14400

access-group OUTSIDE_IN in interface outside

router ospf 1

network 192.168.1.0 255.255.255.0 area 0

network 192.168.11.0 255.255.255.0 area 0

network 192.168.12.0 255.255.255.0 area 0

log-adj-changes

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication serial console LOCAL

aaa authentication http console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.11.0 255.255.255.0 outside

ssh 192.168.0.0 255.255.0.0 outside

ssh timeout 60

ssh version 2

console timeout 0

dhcpd dns 4.2.2.2

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd enable inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 192.168.11.1

webvpn

username mintoo password AILiHuRWFGgkbsI5 encrypted privilege 15

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:ed0c14b97f28804194267c80a621cbca

: end

Switch port config connected to ASA

3550Inside#sh run int fa0/1

Building configuration...

Current configuration : 68 bytes

interface FastEthernet0/1

switchport mode dynamic desirable

end

Thanks

Mahesh

From Inside host unable to ping the ASA inside interface

mahesh18 — Wed, 21 Nov 2012 02:33:55 GMT

Hi,

Here is more update

ciscoasa# clear arp

ciscoasa# ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)

ciscoasa# sh arp

inside 192.168.1.2 000b.fd1c.0800 43

outside 192.168.11.1 0009.e8a2.0080 31

DMZ 192.168.12.1 0013.191d.ec80 18

ciscoasa#

From Inside host unable to ping the ASA inside interface

lcambron — Wed, 21 Nov 2012 02:57:26 GMT

You are denying icmp on the inside:

icmp deny any inside

remove that command and if the issue persists, try configuring the switch port as access for vlan 1.

Regards,

Felipe.

From Inside host unable to ping the ASA inside interface

mahesh18 — Wed, 21 Nov 2012 04:16:09 GMT

Hi Felipe,

It worked like charm i can ping from inside host to inside IP.

Other thing from Inside of DMZ i can not ping inside host.

Is this blocked by design?

Many thanks

MAhesh

From Inside host unable to ping the ASA inside interface

cadet alain — Wed, 21 Nov 2012 07:01:32 GMT

Hi,

interface Vlan3

description DMZ to 3550DMZ

no forward interface Vlan1

nameif DMZ

security-level 50

ip address 192.168.12.2 255.255.255.0

This is Base Licence restriction:

3 active VLANs (3rd VLAN can initiate traffic to only one other VLAN).

So buy a Security plus licence and everything will be alright provided you configure an ACL to permit traffic from lower level to higher level.

Regards.

Alain

Don't forget to rate helpful posts.

From Inside host unable to ping the ASA inside interface

mahesh18 — Wed, 21 Nov 2012 16:03:38 GMT

Hi Alain,

Can you please tell what should i config on ACL to allow traffic from lower to higer.

Thanks

MAhesh

From Inside host unable to ping the ASA inside interface

lcambron — Wed, 21 Nov 2012 16:04:04 GMT

Mahesh,

I'm glad it worked, make sure to mark the post as answered so that others can learn.

Regards,

Felipe.

From Inside host unable to ping the ASA inside interface

mahesh18 — Wed, 21 Nov 2012 16:14:48 GMT

Hi Felipe and Alain,

Many thanks for help.

Regards

MAhesh