topic Ping allowed but not configured in Network Security

Ping allowed but not configured

jeff6strings — Mon, 11 Mar 2019 22:51:09 GMT

We have a Cisco ASA 5580 and the outside interface has a public IP address and we noticed we can ping this address from the Internet. I did a packet capture on the outside interface and confirmed the pings and the IP address sending the pings. The 5580 does not have an access list allowing icmp so I'm not sure what is allowing the pings to this interface.

Appreciate any help.

Jeff

Ping allowed but not configured

Roman Rodichev — Thu, 05 Apr 2012 19:47:00 GMT

icmp permit any outside

icmp permit any unreachable outside

icmp permit any echo outside

icmp permit any echo-reply outside

icmp permit any time-exceeded outside

Ping allowed but not configured

jeff6strings — Thu, 05 Apr 2012 19:50:34 GMT

Roman,

I appreciate the reply but neither of those commands are configured on the ASA and there are no inspect statements allowing icmp and only the implicit deny access rule is configured on the outside interface so I'm still confused as to what is allowing the pings to the outside interface.

Jeff

Ping allowed but not configured

Jouni Forss — Thu, 05 Apr 2012 20:10:01 GMT

Hi,

I did a test on my home ASA 5505 8.4(3)

It seems that if you dont have any "icmp permit/deny" lines configured (ASA default?), the ASA will respond to ICMP from anywhere on the corresponding interface.

If you lets say add one line to allow ICMP to the ASA outside interface and you're pinging from some other network thats not mentioned in the rule you just inserted, the ASA wont respond.

So it seems to be

No "icmp permit/deny" statements = all ICMP allowed
1 or more ICMP statement configured to the interface = only that network/host is allowed to ping interface. Rest are blocked

To be honest I dont know what this is based on but it does seem to work like that after I tried the commands around.

- Jouni

Ping allowed but not configured

jeff6strings — Thu, 05 Apr 2012 20:19:22 GMT

Jouni, thanks for the reply as I was under the impression the ASA denies icmp by default unless manually allowed. Either there is something I'm missing or we have bug based on version and/or configuration we have or I'm wrong assuming pings are denied by default.

Thanks again,

Jeff

Re: Ping allowed but not configured

cpembleton — Fri, 06 Apr 2012 03:38:45 GMT

Pings to the interface are permitted by default. Pings through the asa are denied by default.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic5

hth

Chad

Sent from Cisco Technical Support iPad App