topic Re: ping & tracerout through firewall in Network Security

ping & tracerout through firewall

ronshuster — Mon, 11 Mar 2019 14:26:39 GMT

I am trying to get a few workstations to ping and traceroute to the Internet via an ASA5520. I have a permit ip any any for all incoming traffic hitting the inside interface and still unable to ping\traceroute the Internet.

any idea?

Re: ping & tracerout through firewall

ajagadee — Tue, 16 Dec 2008 16:15:53 GMT

Roni,

It is hard to say what is wrong without the configuration. Have you already configured the NAT, ACL, etc and also you mention few clients, does this mean the other workstations are working. I hope the below URL helps:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Arul

*Pls rate if it helps*

Re: ping & tracerout through firewall

ronshuster — Tue, 16 Dec 2008 16:23:39 GMT

Our internet access works perfectly ok from a NAT & PAT & ACL stand point... only thing is that we cannot ping & traceroute to the Internet.

I have a permit ip any any on all traffic incoming the INSIDE interface. Is that sufficient or do I need to apply the following as well:

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

Re: ping & tracerout through firewall

ronshuster — Tue, 16 Dec 2008 16:46:48 GMT

I just ran a packet capture, results:

RESULTS - The packet is dropped

Info : (rpf violated) Reverse-path verify failed

I tried to remove the following but still unable to ping:

ip verify reverse-path interface Outside

ip verify reverse-path interface Inside

Re: ping & tracerout through firewall

nefkensp — Tue, 16 Dec 2008 21:08:27 GMT

If you're using the asa, you also need to configure the ICMP inspection using the icmp permit command set;

e.g.

icmp permit any inside

icmp permit echo-reply outside

icmp permit unreachable outside

icmp permit traceroute outside

HTH

P-J Nefkens

Re: ping & tracerout through firewall

ajagadee — Tue, 16 Dec 2008 22:23:44 GMT

Hi,

The above lines need to be applied on the outside interface.

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-group 101 in interface outside

The other option is to enable inspection:

For example:

policy-map global_policy

class inspection_default

inspect icmp

Please refer the below URL for details:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Arul

*Pls rate if it helps*