topic Re: Can't ping Outside in ASA5510 in Network Security

Can't ping Outside in ASA5510

helios999 — Mon, 11 Mar 2019 13:12:37 GMT

Guys please help me. I can't ping outside network like yahoo.com when I'm connected to the ASA5510 firewall. Do you have any idea how to set the ACL to allow pinging the outside network?

Thanks.

Re: Can't ping Outside in ASA5510

a.ajiboye — Fri, 11 Jul 2008 08:21:27 GMT

How are you connected to the ASA? Is it via VPN using a VPN client? If you are connecting via VPN client and split tunneling is not enabled on the ASA for the profile your are connecting to the ASA with, you would not be able to ping any address on the Internet. You need to enable split tunneling for this profile.

If you are on a network behind the ASA (i.e. Inside interface of the ASA), then you can enable pinging through the ASA by entering the commands below on the ASA:

config t

policy-map global_policy

class inspection_default

inspect icmp

Regards.

Re: Can't ping Outside in ASA5510

stephen.stack — Fri, 11 Jul 2008 10:41:33 GMT

Hi,

1. Allow ICMP in both directions (by the application of access lists to the source and destination interfaces).

access-list 100 extended permit icmp any any echo-reply

access-list 100 extended permit icmp any any source-quench

access-list 100 extended permit icmp any any unreachable

access-list 100 extended permit icmp any any time-exceeded

2. Enable the ICMP inspection engine to allow ICMP sessions to be treated as bidirectional connections

inspect icmp

HTH - pls rate if it does

Regards

Stephen

Re: Can't ping Outside in ASA5510

helios999 — Sat, 12 Jul 2008 01:46:51 GMT

Thanks for the reply. I'm connected to the ASA behind a network using the DMZ interface. The "inspect icmp" statement is the only missing thing in my config. I will add this and give you an update.

Thanks.

Re: Can't ping Outside in ASA5510

helios999 — Sat, 12 Jul 2008 01:55:36 GMT

Hi, if I will use the "inspect icmp" statement is there a catch with this command?

Is my network still safe?