topic Re: ASA 5510 Virtual IP & Sub-Interfaces in Network Security

ASA 5510 Virtual IP & Sub-Interfaces

ansuman07 — Mon, 11 Mar 2019 11:04:09 GMT

Hi All,

I have a server farm on my DMZ. I have statically NATted the Servers' IP addresses to other IP addresses for the inside & outside networks. I can http in to web server's NATted IP, but i cannot ping these addresses. Is there a way i can ping these virtual addresses.

Can i use the subinterfaces on say the outside or inside interfaces to assign public IPs and then map the addresses of the servers on DMZ to those on the subinterfaces.

Re: ASA 5510 Virtual IP & Sub-Interfaces

purohit_810 — Thu, 30 Aug 2007 12:40:17 GMT

Yes you can do but in that case your all OUTSIDE INterface has priority will be 0.

Open Access list ICMP extended to ping.

Regards,

Dharmesh

Re: ASA 5510 Virtual IP & Sub-Interfaces

srue — Thu, 30 Aug 2007 16:00:50 GMT

To allow inbound pings, you must specify on your outside acl:

permit icmp any any echo

To allow outbound pings (the return response), again, on your outside acl:

permit icmp any any echo-reply

These assume you have no outbound acl's.

The other option, turn on icmp inspection.