topic Can't Ping ASA different interfaces in Network Security

Can't Ping ASA different interfaces

Jayesh Rajan — Mon, 11 Mar 2019 23:11:13 GMT

We are using Cisco ASA 5580 (8.2) firewall. When i try to ping from inside lan to firewall DMZ interface IP it is not pingable and but from inside users i am able to ping firewall inside interface IP address.

I think we can't ping to other interfaces of ASA by default. But can we allow the single IP address who can ping all the interfaces of firewall?

We are not doing any natting in firewall, for that we used the Load Balancer.

Thanks...

Can't Ping ASA different interfaces

Julio Carvajal — Thu, 24 May 2012 17:48:33 GMT

Hello Jayesh,

The ASA as a security device will not allow you to ping a distant interface....

What is a distant interface?

As an example imagine you are on a host behind the inside interface.. You will be able to ping the inside interface but you wil NOT be able to ping the DMZ or outside interface... This because they are distant interface for the inside host..

There is nothing you can do to change that behavior, this is done as a security meassure by the ASA ( Built-in feature)

Regards,

Do rate all the helpful posts

Julio

Can't Ping ASA different interfaces

jong_r0602 — Fri, 25 May 2012 17:13:28 GMT

Hi Jayesh,

Julio is right that pingis not allowed by default. But you can still allow the PING by allowing ICMP in your access-list DMZ for specific host. You need also to allow ICMP from DMZ inteface.

ASA(config)# icmp permit host xxxx echo DMZ

ASA(config)# access-list DMZ-In extended permit icmp xxxx(DMZ host) host yyyy(inside host)

Thanks,

Jong

Can't Ping ASA different interfaces

Julio Carvajal — Fri, 25 May 2012 21:10:13 GMT

Hello Jong,

I think he is refering to ping the DMZ interface from the inside.

Regards,

Can't Ping ASA different interfaces

jong_r0602 — Fri, 25 May 2012 21:22:11 GMT

Hi Julio,

Oh yes.. its the interface and not the host. Your correct, ping is not allowed for this scenario.

Regards,

Jong

Can't Ping ASA different interfaces

Julio Carvajal — Fri, 25 May 2012 23:38:39 GMT

Hello Jong,

Yep, that is right.

Have a good one!

Julio

Can't Ping ASA different interfaces

Jayesh Rajan — Sun, 10 Jun 2012 06:30:26 GMT

Thanks All....

Is there any cisco document is available where this mentioned?

Can't Ping ASA different interfaces

nkarthikeyan — Sun, 10 Jun 2012 09:36:54 GMT

Yes. Pls refer the below cisco document.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic0