topic Re: Block ping to outside interface of ASA from internet in Network Security

Block ping to outside interface of ASA from internet

mitchen — Mon, 11 Mar 2019 12:49:59 GMT

We recently had a security audit of our network carried out.

One of the minor points raised was that ping responses were received from our firewall's public IP address (i.e. the outside interface) and this may allow an attacker to enumerate our network.

We've therefore been asked to turn off ping responses from our outside interface.

However, I can't find a way to prevent our outside interface responding to ping requests sent from the internet? (I can successfully block ICMP requests going THROUGH the firewall)

I have an access-list applied to the outside interface with "deny icmp any any" but the outside interface still responds to pings.

How can this be achieved?

Re: Block ping to outside interface of ASA from internet

m.sir — Mon, 26 May 2008 14:44:34 GMT

You cant use ACLs for that, for allowing(denying) ICMP to interface use ICMP command in global configuration.. (ICMP is permited by default)

icmp deny any outside

Check this for more info

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/i1_72.html#wp1631466

hope that helps rate if it doest

Re: Block ping to outside interface of ASA from internet

suschoud — Mon, 26 May 2008 17:56:15 GMT

if you want asa not to respond to any icmp echo request coming from internet,use :

ASA5510-Single(config)# icmp deny any echo-reply outside

By this way,asa would still be able to ping any ip address on internet.

If you use :

ASA5510-Single(config)# icmp deny any outside

asa would not be able to ping on internet.

HTH,

Sushil

Cisco TAC

Re: Block ping to outside interface of ASA from internet

mitchen — Wed, 28 May 2008 08:33:04 GMT

Thanks, that worked fine.

Re: Block ping to outside interface of ASA from internet

sv7 — Thu, 21 Jul 2022 13:18:00 GMT

Hi Buddy,

I have tried the command icmp deny any echo-reply outside but after my complete internet went down. Is it any alternative way i can restrict ping from internet

回复： Block ping to outside interface of ASA from internet

wangxkc — Mon, 24 Oct 2022 07:56:09 GMT

The below command is correct.

icmp permit any echo-reply Outside
icmp permit any time-exceeded Outside
icmp permit any unreachable Outside

refer to:

https://community.cisco.com/t5/network-security/block-ping-to-outside-interface-but-allow-ping-out-from-asa/td-p/2317192