topic Allow ICMP with PAT in Network Security

Allow ICMP with PAT

mtehonica — Mon, 11 Mar 2019 23:18:27 GMT

From what I've read, what I would like to accomplish isn't possible.

We have 5 static IPs. 4 for servers and 1 for the firewall. I can ping the firewall fine from the outside but can't ping the other 4 IPs. Doesn't sound like its possible to configure this since ICMP doesn't use ports and the firewall wouldn't know how to route ICMP traffic to the different IPs.

Can anyone else confirm this?

Thanks!

Sent from Cisco Technical Support iPhone App

Allow ICMP with PAT

Jennifer Halim — Wed, 13 Jun 2012 02:59:56 GMT

Have you configured the static NAT statement for the servers yet?

Also, have you allowed ICMP on your outside interface for those 4 static IP Addresses?

You would be able to ping once you have the above 2 configured.

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 03:07:17 GMT

I have ICMP enabled on my router public IP and can ping that fine.

And I've configured the static NAT for my servers. For example... Public IP 96.249.40.100 (not my real ip) on port 80 maps to 192168.1.100 on port 80.

Not sure how I'd allow ICMP through to 96.249.40.100....

Sent from Cisco Technical Support iPhone App

Re: Allow ICMP with PAT

Jennifer Halim — Wed, 13 Jun 2012 03:16:59 GMT

Do you have access-list applied to your outside interface? You should add "permit icmp" for those addresses that you want to ping.

Re: Allow ICMP with PAT

gouravbathla — Wed, 13 Jun 2012 05:33:46 GMT

If outsidein is the access list applied on your outside interface.

access-list outsidein extended permit icmp any (public_ip) echo-reply
access-list outsidein extended permit icmp any (public_ip) echo
access-group outsidein in interface outside

Note:-For version upto 8.2

You would be able to ping.

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 12:17:11 GMT

I have the following in my access list:

access-list outside_access_in_1 remark Allow ICMP traffic

access-list outside_access_in_1 extended permit icmp any any echo-reply

access-list outside_access_in_1 extended permit icmp any any unreachable

access-list outside_access_in_1 extended permit icmp any any time-exceeded

And that is applied to my outside interface inbound...

access-group outside_access_in_1 in interface primaryisp

Here is one of my NAT rules which...

object network asp-wss-3-http-vz

nat (inside,primaryisp) static 96.249.40.100 service tcp www www

Do I need to specifically allow ICMP to asp-wss-3-http-vz or to 96.249.40.100?

Thanks for the help!

Re: Allow ICMP with PAT

Jennifer Halim — Wed, 13 Jun 2012 13:16:05 GMT

The ICMP type that you would need to permit is "echo" and that has not been included in the access-list.

Please add the following:

access-list outside_access_in_1 extended permit icmp any any echo

and you don't need to specifically allow icmp to the host/ip address.

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 13:32:33 GMT

So I added that but I still cannot ping anything except the IP of the actual router IP.

access-list outside_access_in_1 remark Allow ICMP traffic

access-list outside_access_in_1 extended permit icmp any any echo

access-list outside_access_in_1 extended permit icmp any any echo-reply

access-list outside_access_in_1 extended permit icmp any any unreachable

access-list outside_access_in_1 extended permit icmp any any time-exceeded

Here is my ASDM log when I try to ping it...

Jun 13 2012

09:31:29

96.249.40.18

96.249.40.10

Deny inbound icmp src primaryisp:96.249.40.18 dst primaryisp:96.249.40.10 (type 8, code 0)

Re: Allow ICMP with PAT

Jennifer Halim — Wed, 13 Jun 2012 13:37:51 GMT

Is 96.249.40.10 "primaryisp" interface ip address?

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 13:40:42 GMT

No, the primaryisp interface is 96.249.40.14. The 4 other IPs that I want to get ICMP relies from are .10 - .13. I'm using PAT for various services (http, https, etc) on those other 4 IPs.

Re: Allow ICMP with PAT

Jennifer Halim — Wed, 13 Jun 2012 13:56:12 GMT

Also need the following NAT:

object service ping

service icmp echo

object network asp-wss-3-http-vz-ping

host

nat (inside,primaryisp) static 96.249.40.10 service ping ping

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 14:14:08 GMT

nat (inside,primaryisp) static 96.249.40.10 service ping ping

ERROR: % Invalid input detected at '^' marker.

Re: Allow ICMP with PAT

mtehonica — Wed, 13 Jun 2012 18:51:08 GMT

Bump! Anyone suggestions on this would be appreciated!

Re: Allow ICMP with PAT

John Peterson — Wed, 13 Jun 2012 21:30:07 GMT

Are you able to staticlly nat a single IP address with all ports to a local IP address or do you only want to nat icmp?

Re: Allow ICMP with PAT

mtehonica — Thu, 14 Jun 2012 02:12:08 GMT

I already have some NAT configured but I also need to get ICMP responses on all the IPs.

Sent from Cisco Technical Support iPhone App

Re: Allow ICMP with PAT

Jennifer Halim — Thu, 14 Jun 2012 03:49:00 GMT

Did you configure all the 5 lines advised earlier? or just 1 line?

object service ping

service icmp echo

object network asp-wss-3-http-vz-ping

host

nat (inside,primaryisp) static 96.249.40.10 service ping ping

Re: Allow ICMP with PAT

mtehonica — Thu, 14 Jun 2012 12:08:02 GMT

Yes, I did all 5 lines. When I enter "nat (inside,primaryisp) static 96.249.40.10 service " I can only choose TCP or UDP.

Re: Allow ICMP with PAT

Jennifer Halim — Fri, 15 Jun 2012 05:03:50 GMT

Do you need to configure static PAT, or static NAT is OK?

From version 8.3 onwards, it seems that you won't be able to ping the static PAT IP anymore.

Re: Allow ICMP with PAT

mtehonica — Fri, 15 Jun 2012 12:04:37 GMT

Yes, I need to do it using PAT.

Sent from Cisco Technical Support iPhone App

Re: Allow ICMP with PAT

mtehonica — Sun, 17 Jun 2012 01:38:43 GMT

Still haven't been able to figure this out. Anyone else have any ideas??

Sent from Cisco Technical Support iPad App