topic Re: Permit ICMP from inside interface to Outside Interface in Network Security

Permit ICMP from inside interface to Outside Interface

batumibatumi — Mon, 11 Mar 2019 13:25:06 GMT

Friends, i have ASA 5520. I opened pop3 and smtp port for mail. But, from outside network (internet) when i type my ASA's public IP address in the pop3 and smtp mail works fine. But inside in my network in this case mail is not working. ISP staff told me that inside host should ping ASA's outside IP but i can not PING...

My task is next: Inside host should access mail using ASA Public IP address in POP3 and SMTP field

Re: Permit ICMP from inside interface to Outside Interface

dhananjoy chowdhury — Mon, 04 Aug 2008 06:00:32 GMT

Try this...

policy-map global_policy

class inspection_default

inspect icmp

Re: Permit ICMP from inside interface to Outside Interface

Marwan ALshawi — Mon, 04 Aug 2008 06:03:21 GMT

first about ping

in ASA u cant ping ASA interface from another interface even if u enable icmp inspection u will be able to pass icmp but not ping interface from another interface!!

so if u have access to ur network dont worry about this ping issue

secondly r u using static nat for ur mail server?

and if the users in the network reside in the same interface to the mail server why udont us its private IP for those users

for example if the server ip is 10.10.10.1

put this ip for inside users

also some time esmtp insspection make problems try to disable it

good luck

if helpful rate please

Re: Permit ICMP from inside interface to Outside Interface

batumibatumi — Mon, 04 Aug 2008 06:16:48 GMT

I'm using ASDM and in the servic policy i mark ICMP in the default inspection. To tell you true to disabl ESMTP did not try yet.

P.S. Yes, as you said to write down mail's server inside IP mail works fine, but my users every day go out and POP3 is important for me.