topic Re: ICMP Inspection in Network Security

ICMP Inspection

hadisharifi — Mon, 11 Mar 2019 20:14:57 GMT

Hi, I have configured the ASA to inspect ICMP but when trying to ping from DMZ to outside I don't get any echo replies.

Here is the config.

policy-map global_policy

class inspection_default

inspect icmp

nat (DMZ,outside) source dynamic DMZ-Subnet DMZ-NAT-POOL

access-list DMZ_access_in extended permit ip 10.0.22.0 255.255.255.0 any

The debug icmp trace on the ASA shows:

ICMP echo request from DMZ:10.0.22.51 to outside:124.x.x.x ID=512 seq=29440 len=32

ICMP echo request translating DMZ:10.0.22.51 to outside:203.14.x.x

And in the log from ASDM it shows:

Built outbound ICMP connection for faddr 124.x.x.x/0 gaddr 203.14.x.x/512 laddr 10.0.22.51/512

Teardown ICMP connection for faddr 124.x.x.x/0 gaddr 203.14.x.x/512 laddr 10.0.22.51/512

Thanks

Re: ICMP Inspection

Jennifer Halim — Thu, 31 Mar 2011 03:28:14 GMT

Is the outside host actually replying to the ECHO Request packet?

You might want to run packet capture on both inside and outside interfaces to see if ECHO Request is getting sent out, and ECHO Reply is coming in from the outside host.

Re: ICMP Inspection

hadisharifi — Thu, 31 Mar 2011 04:42:57 GMT

Hi, I have just turned on debug on the router that is connected to the outside interface and it is sending echo reply to the ASA.

ICMP: echo reply sent, src 203.14.x.x, dst 203.14.x.x, topology BASE, dscp 0 topoid 1

The destination ip is the tranlslated (gaddr).

Thanks

Re: ICMP Inspection

Jennifer Halim — Thu, 31 Mar 2011 06:32:33 GMT

OK, so the router is sending the reply, does the ASA receive the ECHO Reply?

Have you perform packet capture on both inside and outside interface to check where it's failing?