topic ICMP from outside in Network Security

ICMP from outside

Lakeram Harrypersaud — Mon, 11 Mar 2019 20:58:32 GMT

I have an ASA5510 running version 8.4. ICMP is blocked from the internet to the outside interface of our firewall but now our ISP is requesting us to allow ICMP from their network to the outside of our ASA. I need to allow ICMP from three blocks of IP Addresses?

Any help will be greatly appreciated

Thanks,

Lake

ICMP from outside

varrao — Wed, 13 Jul 2011 13:05:48 GMT

Hi Lakeram,

You need to enable the following config:

icmp permit outside

to enable icmp on outside interface.

Thanks,

Varun

ICMP from outside

Lakeram Harrypersaud — Wed, 13 Jul 2011 13:25:36 GMT

When i type:

icmp permit ?

I only get an option for ANY Or HOST

I need to allow ICMP from network address 1.1.1.1/24

Can you please tell me how to do that?

Thanks,

Lake

ICMP from outside

varrao — Wed, 13 Jul 2011 14:45:31 GMT

Hi lake,

Use this:

icmp permit 192.168.0.0 255.255.255.0 outside

try it in the config mode.

This should definitely work

Thanks,

Varun

ICMP from outside

Lakeram Harrypersaud — Wed, 13 Jul 2011 15:28:50 GMT

That worked like a charm.

I really appreciate that.

Thank you very much

Regards,

Lake

ICMP from outside

Balakumaresan Saravanan — Wed, 13 Jul 2011 16:19:00 GMT

Hi varun,

why we are using 192.168.0.0 network in that access-list. Lake mentioned that he wants to allow icmp access from 1.1.1.1/24. Kindly explain.

Thanks,

Bala

ICMP from outside

Lakeram Harrypersaud — Wed, 13 Jul 2011 16:51:16 GMT

I am sorry for the confusion guys but i made a typo. I meant to say 1.1.1.0/24. Varun's answer is what i am looking for.

Thanks,

Lake

ICMP from outside

varrao — Wed, 13 Jul 2011 16:57:42 GMT

Hi Bala,

I guess I get your point, what Lake's requirement was to be able to ping the outside interface of the ASA, and the access-list that you might be having is for the ping traffic through the box. Lake's requirement was ping to the box.

Let me know if that makes it clear.

Thanks,

Varun

ICMP from outside

Lakeram Harrypersaud — Wed, 13 Jul 2011 17:29:20 GMT

Hi Guys,

My requirement is to ping TO the outside interface from the internet not THROUGH it. I guess Varun solution is the correct one?

Thanks,

Lake

ICMP from outside

Balakumaresan Saravanan — Mon, 01 Aug 2011 11:24:34 GMT

thanks varun. sorry for the delayed reply.. thank u very much..