topic Re: Allowing ICMP in Network Security

Allowing ICMP

udayashankarsg — Mon, 11 Mar 2019 10:17:06 GMT

Hi,

I have a Pix 525 firewall in my lab and i am practicing in it.I have connected two systems to inside and outside interface each.i have configured 172.25.15.1 as inside interface ip address and 172.25.30.1 as outside ip address i want the system wich is connected to inside interface should ping outside interface,i have configured the access-list as

(access-list 101 permit icmp any any)

(access-group 101 in interface outside).the inside network is nated to the outside interface but still i am not able to ping the outside interface.please can any one help me in resolving this.

Re: Allowing ICMP

hoogen_82 — Sat, 19 May 2007 16:17:04 GMT

Generally inside users wouldn't be able to ping outside interface of the PIX

Use the following access-list to solve your problem.

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-group 101 in interface outside

or if you are runng 7.X include Inspect ICMP.

-Hoogen

Do rate if this post helps 🙂

Re: Allowing ICMP

emad.silicon — Sun, 20 May 2007 08:44:57 GMT

If you want to ping the outside interface

then you shuld write this command in configuration mode

pix(config)#icpm permit any outside

bye

Re: Allowing ICMP

edw — Fri, 01 Jun 2007 11:34:56 GMT

Hi,

I have tried this and it works but only if you add a entry to the inside interface like this

access-list InsideACL permit icmp host 10.0.0.1 any echo

otherwise 10.0.0.1 can't ping anything - is this correct ???

Thanks

Re: Allowing ICMP

cpembleton — Fri, 01 Jun 2007 17:36:40 GMT

According to cisco doc pinging an interface on the far side is not possible. IE trying to ping the outside interface from a host on the inside. With that being said I have seen the same config on 2 different firewalls and one allows it and the other doesn't.

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#pingsown

Chad

Re: Allowing ICMP

acomiskey — Fri, 01 Jun 2007 17:41:13 GMT

edw, yes if you have an acl in your inside interface then you would have to allow the traffic as well.

Re: Allowing ICMP

edw — Fri, 01 Jun 2007 23:02:10 GMT

Hi,

So to confirm If I have a internal machine say 10.0.0.1 and I want to ping my outside machine say 16.16.16.16.

Then to do this from the inside I would need these acls....

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-group 101 in interface outside

access-list InsideACL permit icmp host 10.0.0.1 any echo

access-group InsideACL in interface inside

Thanks

Re: Allowing ICMP

edw — Fri, 28 Mar 2008 10:19:59 GMT

Hi,

If I allow inspect ICMP - I still have to add the above entries into the ACL for the traffic to transverse - is this correct? The Cisco ICMP doc is pretty usless as it leads you to believe that this isn't nessacery ?

Thanks