topic Re: ASA/PIX not responding to Pings from Outside interface in Network Security

ASA/PIX not responding to Pings from Outside interface

Charlie Mayes — Mon, 11 Mar 2019 17:45:08 GMT

I need a ASA/PIX firewall to respond to my ping eneting the outside interface from a specific subnet. Is this ACL correctly written to do that?

access-list 101 permit icmp 76.X.X.X 255.255.255.192 any echo-reply
access-group 101 in interface outside

Jon Marshall — Thu, 13 May 2010 13:45:50 GMT

iketurner931 wrote:

I need a ASA/PIX firewall to respond to my ping eneting the outside interface from a specific subnet. Is this ACL correctly written to do that?

access-list 101 permit icmp 76.X.X.X 255.255.255.192 any echo-reply
access-group 101 in interface outside

An acl allows ping through the firewall not to the firewall.

You need this instead -

icmp permit 76.x.x.x 255.255.255.192 echo-reply outside

however by default an ASA should respond to ping on it's interfaces anyway so you need to check your config.

Note also that you cannot ping across the ASA to an interface so if you are outside you can ping the outside interface but not any of the others.

Jon

Charlie Mayes — Thu, 13 May 2010 13:59:50 GMT

Thanks Jon,

Are you saying that the Pix by default will not respond to pings but the ASA will?

Jon Marshall — Thu, 13 May 2010 14:08:53 GMT

iketurner931 wrote:

Thanks Jon,

Are you saying that the Pix by default will not respond to pings but the ASA will?

No, the pix should respond by default to pings as well.

Jon

Charlie Mayes — Thu, 13 May 2010 14:14:30 GMT

Ok Thanks.