topic Re: inside to outside ping in ASA in Network Security

inside to outside ping in ASA

ashish.sehgal — Mon, 11 Mar 2019 15:00:59 GMT

Hi, I have configured an ASA recently. After finishig of basic configurations, I tried ping from inside to outside interface and vice versa. But ping is not successful. I was getting ?????. I have tried "icmp permit any OUTSIDE" and "icmp permit any INSIDE" in vain. Please help me with a solution.

Re: inside to outside ping in ASA

Ivan Martinon — Thu, 05 Mar 2009 17:14:56 GMT

Are you pinging from a host behind the ASA to a host outside the ASA?

If yes you need to enable ICMP inspection under the policy map:

policy-map global_policy

class inspection_default

inspect icmp

Or are you using the inside interface to ping the outside interface?

If yes this is not supported.

Re: inside to outside ping in ASA

JamesLuther — Thu, 05 Mar 2009 19:17:44 GMT

Hi,

The commands "icmp permit any OUTSIDE" and "icmp permit any INSIDE" control ICMP to the ASA itself.

To allow icmp through the ASA then use access-lists

Regards

Re: inside to outside ping in ASA

JamesLuther — Thu, 05 Mar 2009 19:19:56 GMT

Here, try reading this for more information

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic2

Re: inside to outside ping in ASA

sushil — Fri, 06 Mar 2009 07:56:04 GMT

Try enabling icmp inspect as per Ivan.

Re: inside to outside ping in ASA

ashish.sehgal — Fri, 06 Mar 2009 10:29:32 GMT

Read but still not working, need more clarity about ASA permit and deny and also about ICMP

Re: inside to outside ping in ASA

JamesLuther — Fri, 06 Mar 2009 10:37:43 GMT

Hi,

Here are some configuration examples on how to get ICMP thorugh the ASA working.

access-list in_on_inside permit icmp any any echo

access-group in_on_inside in interface inside

access-list in_on_outside permit icmp any any echo-reply

access-group in_on_outside in interface outside

access-list in_on_inside permit icmp any any echo

access-group in_on_inside in interface inside

policy-map global_policy

class inspection_default

inspect icmp

Also, is nat-control disabled on your firewall? Yo ucan make sure by typing

no nat-control

Regards

Re: inside to outside ping in ASA

Ivan Martinon — Fri, 06 Mar 2009 15:54:04 GMT

How are you trying to ping? Is it from a host behind asa to a host outside asa? or from the actual interfaces?

Re: inside to outside ping in ASA

ashish.sehgal — Sat, 07 Mar 2009 16:16:46 GMT

I am pinging from a switch and my Laptop behind ASA.

Just simply pissed off. Today it started pinging and I started testing failover, powered off my secondary ASA and since then it again stopped Pinging. I restarted my failover ASA but 😞

PFA configuration of all the devices and let me know if you find any configuration issue in any of the device.

Re: inside to outside ping in ASA

ashish.sehgal — Tue, 10 Mar 2009 03:24:01 GMT

Frnds, Thanks a lot for all your suggestions and help. The problem is solved. Apparently it was a routing loop problem causing the issue.

Ashish