topic Re: Cisco ASA & Ping in Network Security

Cisco ASA & Ping

Ciscouser20188 — Fri, 21 Feb 2020 16:34:19 GMT

Is this possible?

My goal is to block ping reply from ASA outside interface, but to allow ping reply to group of hosts to the outside interface

my config right now

icmp permit any unreachable outside

with the above config, the ASA outside interface do not respond to ping (which is what I want)

now I would like 10 hosts located on the internet to ping the outside interface (would this setup be possible?)

Thank you

Sheraz.Salim — Thu, 13 Dec 2018 19:03:32 GMT

yes this is possible

icmp permit any unreachable outside

icmp permit host 8.8.8.8 outside

please rate me if i help you.

Ciscouser20188 — Thu, 13 Dec 2018 19:44:32 GMT

I know about this, but what if I have 30 hosts?

I tried icmp permit but the object group is not an option

I even tried creating access list and applying to the outside interface, with no luck

Sheraz.Salim — Thu, 13 Dec 2018 20:01:38 GMT

yes I lab this up and tried with access-list no luck and even with object-group does not show up either.

Ciscouser20188 — Thu, 13 Dec 2018 22:08:21 GMT

right same here..

I created an access-list and and also created a Icmp service option will all icmp services..no luck.

I believe I read somewhere about using control plane access-list...I will look into that.