ASA Firewall - Restrict ICMP from a subnet to any

[par13]

Hi

I am trying to create a simple access-list rule that restrict an external subnet to ping to any host behind the firewall.

The rule is access-list outside-access_in permit icmp host 172.2.1.2 any

The rule loads without no issues. But, the external host cannot ping to any host in the firewall.

However, if one change the rule to say access-list outside-access_in permit icmp any any, then, it works.

What am I missing?

[Karsten Iwen]

>  access-list outside-access_in permit icmp host 172.2.1.2 any

Which IP are you using here? Up to ASA v8.2 it has to be the translated IP, from 8.3 onwards, it has to be the real IP of the host.

And do you have a valid translation or have you exempted the traffic from NAT (based on your needs)?

[par13]

HI

This is an old PIX 515 still running 6.3(5)