topic Re: asa 7.0.2 and access-list element removing not working in Network Security

asa 7.0.2 and access-list element removing not working

r.spiandorello — Fri, 21 Feb 2020 08:22:10 GMT

Hy,asa 5510 with 7.0.2 version and icmp echo traffic from dmz host to an outside host and echo-reply from the outside host to dmz host.

If I remove the specific ace of the icmp, the traffic still goes-on even if it remains only the ace "deny ip any any" on the 2 access-lists.

With show conn I can see the 2 icmp sessions.

Why ?

nkhawaja — Fri, 02 Sep 2005 21:22:54 GMT

i think the reason is due to the fact that icmp fixup is enabled, allowing echo replies to come back

r.spiandorello — Sat, 03 Sep 2005 11:53:48 GMT

Hy, thank you but it runs even if I remove the access-list element that allows the echo.

Could it be related to the new icmp timeout parameter ?

After I have removed the access-list element, if I stop the pc to ping and then I start it again, the new ping is denied.

It seems like the "icmp session" within the timeout is allowed.

Greatings

Renato

nkhawaja — Sat, 03 Sep 2005 18:02:12 GMT

so for the existing ICMP sessions, they are letting through, but the new sessions will not be.

if you remove the ACL, then do a clear xlat, it will brake your contiuous icmp as well

r.spiandorello — Mon, 05 Sep 2005 06:09:28 GMT

It's true, now how to remove timeout icmp 0:00:02 ?

"no timeout icmp" and "timeout 0:00:00" does not work.

Thank you in advance