topic Re: Ping through ASA in Network Security

Ping through ASA

ayman emara — Mon, 11 Mar 2019 16:45:51 GMT

i have a problem as i permitted PING by the following commands:

icmp permit any echo admin-outside
icmp permit any echo-reply admin-outside
icmp permit any echo admin-inside
icmp permit any echo-reply admin-inside

i can ping from outside (PC) to the inside (PC) but i can't ping from the inside(PC) to the outside(PC)

and another question can the interfaces of the firewall ping each outher if i used Extended ping on the firewall -- because in this status both interfaces are not pingging each other too ??

Thanks In Advance

Ayman Yehia

Re: Ping through ASA

Jon Marshall — Sat, 05 Dec 2009 23:57:00 GMT

207558867 wrote:

i have a problem as i permitted PING by the following commands:

icmp permit any echo admin-outside
icmp permit any echo-reply admin-outside
icmp permit any echo admin-inside
icmp permit any echo-reply admin-inside

i can ping from outside (PC) to the inside (PC) but i can't ping from the inside(PC) to the outside(PC)

and another question can the interfaces of the firewall ping each outher if i used Extended ping on the firewall -- because in this status both interfaces are not pingging each other too ??

Thanks In Advance

Ayman Yehia

Ayman

The "icmp permit ..." command controls who interfaces on the firewall can be pinged not which devices can ping through the firewall.

Have a look at this document which covers how to allow ping through an ASA/Pix firewall -

ASA ping

Can the interfaces ping each other - no they can't.

Jon

Re: Ping through ASA

Conor Cunningham — Sun, 06 Dec 2009 19:56:24 GMT

Hi Yehia,

I believe you need to add ICMP to your inspection policy-map.After I issued 'inspect icmp' from within my policy-map it worked.

On my ASA 5505 in my home lab I have the following;

class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512

policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global

Hope that helps.

Conor

Re: Ping through ASA

ayman emara — Mon, 07 Dec 2009 07:54:28 GMT

Thanks alot adding the ICMP to the inspection already did it

Re: Ping through ASA

JaggerSystems — Thu, 16 Mar 2023 12:02:21 GMT

For me it was the security-level of the interface was too high. A quick test of this by changing to the same security-level resolved the access. An ACL was put in place on the interface to secure traffic.