topic Re: enable ping to public vpn profile ip in Network Security

enable ping to public vpn profile ip

martimanya — Mon, 11 Mar 2019 17:40:04 GMT

How i enable ping to public vpn ip.

for example my outside interface is 172.20.10.2 and my public profile vpn ip is 217.122.142.198, and i need to ping to this public ip from another network.

Re: enable ping to public vpn profile ip

Federico Coto Fajardo — Mon, 03 May 2010 15:47:51 GMT

Hi,

If I understand correctly, your VPN client connects to 217.122.142.198, correct?

You need to PING that IP?

As you mentioned, I'm not able to PING that public IP either (from the Internet).

This could be because the VPN terminating end-point itself (ASA, IOS Router, etc) is not allowing PING replies.

Another reason is because there's another device in front blocking PINGs.

So, please clarify the following:

1. What device is the VPN endpoint?

2. Are there any other devices in front that might be blocking ICMP?

Federico.

Re: enable ping to public vpn profile ip

martimanya — Tue, 04 May 2010 06:05:24 GMT

Hi Federico,

1 - ASA is the device VPN Endpoint

2 - One router C2800 is in front of ASA but not blocks ICMP.

thanks

Re: enable ping to public vpn profile ip

Jennifer Halim — Tue, 04 May 2010 09:23:03 GMT

You would need to check if you have an icmp statement on your ASA: sh run icmp

If you do, then you would need to permit icmp on the ASA outside interface if you are trying to ping 217.122.142.198. Assuming that the ASA outside ip is 217.122.142.198, then you would need to add:

icmp permit any outside

Re: enable ping to public vpn profile ip

martimanya — Tue, 04 May 2010 10:02:14 GMT

Thanks Halijen,

but i had already added "icmp permit any OUTSIDE"

Re: enable ping to public vpn profile ip

Jennifer Halim — Tue, 04 May 2010 10:08:40 GMT

If "icmp permit any outside" has been configured, you should be able to ping the ASA outside interface ip address. It doesn't sound like the ping packet is reaching the ASA interface. You can run packet capture on the ASA outside interface to see if the ping packet actually reaches the ASA outside interface.

access-list cap-out permit icmp any host 217.122.142.198

access-list cap-out permit icmp host 217.122.142.198 any

cap cap-out access-list cap-out interface outside

Try to ping, then check the output of: show cap cap-out

If you don't see anything, that means the ping does not even reach the ASA.