topic ping through ASA in Network Security

ping through ASA

Kashish_Patel — Mon, 11 Mar 2019 23:16:52 GMT

Could some security expert please help me understand icmp behavior for an ASA running 8.0 or 8.2?

My inside hosts (sitting behind the inside interface of ASA) can ping an external IP (on internet) . But when I ping that same external IP from the firewall, I don't get any reply.

Thanks,

Kashish

ping through ASA

Jennifer Halim — Fri, 08 Jun 2012 02:18:56 GMT

Do you have "icmp" command configured on your ASA that might be blocking it.

You can configure:

icmp permit any outside

ping through ASA

Kashish_Patel — Fri, 08 Jun 2012 02:48:44 GMT

As per packet tracer, ping should be successful.

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group citrix-dmz1-perm-all-tmp in interface citrix-dmz1

access-list citrix-dmz1-perm-all-tmp extended permit ip any any

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 1746235146, packet dispatched to next module

Phase: 7

Type: ROUTE-LOOKUP

Subtype: output and adjacency

Result: ALLOW

Config:

Additional Information:

found next-hop 10.244.16.185 using egress ifc outside

adjacency Active

next-hop mac address 0015.63e8.d3d1 hits 12697093

Result:

input-interface: citrix-dmz1

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

Still only the inside hosts (sitting behind the inside interface of ASA) can ping an external IP (on internet) . But when I ping that same external IP from the firewall, I don't get any reply.

ping through ASA

Jennifer Halim — Fri, 08 Jun 2012 02:49:50 GMT

Can you please share your config. Thx

ping through ASA

Kashish_Patel — Fri, 08 Jun 2012 03:02:53 GMT

Hi Jennifer,

I have sent you the config file as a private message.

Thanks,

Ritika

ping through ASA

Jennifer Halim — Fri, 08 Jun 2012 03:05:02 GMT

The reason why you can't ping from the ASA itself is because your ASA outside interface has private IP Address hence it's not routable on the Internet.

All your internal network has public IP assigned, therefore you can ping external host on the Internet.