topic Access (or Ping) from Inside host to Outside host in Network Security

Access (or Ping) from Inside host to Outside host

Tang-Suan Tan — Mon, 11 Mar 2019 21:42:09 GMT

Hi all :

Attach is my ASA5505 config file.

I am trying to ping from my inside host (192.168.1.110) to outside host (192.168.2.5) but could not make it. In fact, the inside is with high security (100) and outside low security (0) and this shoud be no problem but still couldn't make it.

I have setup the static route from inside to outside. I also setup the access rule and apply the rule at the outside interface for any host from outside interface 192.168.2.0/24 to access the inside host 192.168.1.110/24.

I try also to disable the NAT rule by using several NAT command.

Can anybody help? Thanks!

Access (or Ping) from Inside host to Outside host

varrao — Tue, 25 Oct 2011 19:01:36 GMT

Hi Tang-Suan,

You just need to allow return traffic on the ASA, for that you can add this acl:

access-list outside_access_in extended permit icmp any any

and it shoudl work after that.

Access (or Ping) from Inside host to Outside host

varrao — Tue, 25 Oct 2011 19:03:51 GMT

You can add icmp inspection as well, if not ACL, like this:

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

You'll also find, very good explanation by Mike on this post:

https://supportforums.cisco.com/thread/2112005?tstart=0

Hope that helps.

Thanks,

Varun

Re: Access (or Ping) from Inside host to Outside host

Tang-Suan Tan — Wed, 26 Oct 2011 15:43:38 GMT

Hi Varun :

I have added in

access-list outside_access_in extended permit icmp any any

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

but it still not work.

Attach please see the latest config file.

Can you look at the NAT command and Static Route command? Are they correct?

Beside that anything that you can advise? Thanks!

Re: Access (or Ping) from Inside host to Outside host

Tang-Suan Tan — Wed, 26 Oct 2011 17:06:44 GMT

Hi Varun :

Sorry that the inside now can ping to outside and the reason is due to the wireless network gateway take over the firewall gateway since my wireless network also in 192.168.1.x/24.

After i disable the wireless, it works.

This problem is found after i used the tracert and noticed that it goes to the wireless gateway 192.168.1.254 instead of 192.168.1.1 of ASA5505 interface.

Thanks for your advise for the few command also to make it work.

The problem now is i cannot ping from outside host 192.168.2.5 to inside host 192.168.1.110. Can you help?

The config file is the same as running-config2. Thanks!

Access (or Ping) from Inside host to Outside host

cadet alain — Wed, 26 Oct 2011 17:26:38 GMT

Hi,

for trafic originating from a low security level to a high security level you have to configure an ACL permiting this traffic and apply it inbound on the low security level interface.

access-list ICMP_OUT_IN extended permit icmp any any

access-group ICMP_OUT_IN in interface outside

Regards.

Alain.

Access (or Ping) from Inside host to Outside host

Tang-Suan Tan — Fri, 28 Oct 2011 09:23:47 GMT

Thanks Varun and Cadet :

Your answers are correct and my problem is solved. The problem of outside host ping to inside host is due to my inside host firewall, after disable it, it is ok now.

For new problem, I will open new discussion.

Many thanks!