cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


228
Views
0
Helpful
7
Replies
Beginner

Can't ping through ASA

Hi

For some reason I can't ping from my internal network to the external network through the ASA in my network. I have attached a copy of my Packet tracer file. Any help would be appreciated.

1 ACCEPTED SOLUTION

Accepted Solutions
VIP Advisor RJI VIP Advisor
VIP Advisor

Re: Can't ping through ASA

So you are actually pinging from outside/external network to inside/internal, not the other way around. Obviously this is a packet tracer lab and not a production network, but is 172.16.1.0 network routable from the outside? Does the next hop of 204.0.1.0 know how to reach 172.16.1.0 network (are there routes define on each hop)? Or is nat required? In which case you'd need to define a static NAT.

Whatever device you are pinging on the 172.16.1.0 network, is it's default gateway the ASA?

View solution in original post

7 REPLIES 7
VIP Advisor RJI VIP Advisor
VIP Advisor

Re: Can't ping through ASA

Hi,
I don't have packet tracer to load your topology, but try entering the command "fixup protocol icmp" to inspect icmp traffic. If that doesn't work, please attach the running configu of your ASA.

HTH
Beginner

Re: Can't ping through ASA

Here is my running config for the ASA

ciscoasa#show run

: Saved

:

ASA Version 8.4(2)

!

hostname ciscoasa

names

!

interface Ethernet0/0

switchport access vlan 30

!

interface Ethernet0/1

switchport access vlan 30

!

interface Ethernet0/2

switchport access vlan 30

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 3

!

interface Ethernet0/6

!

interface Ethernet0/7

switchport access vlan 3

!

interface Vlan1

no nameif

no security-level

no ip address

!

interface Vlan2

nameif outside

security-level 0

ip address 10.0.0.2 255.255.255.252

!

interface Vlan3

no forward interface Vlan30

nameif dmz-zone

security-level 50

ip address 10.20.30.1 255.255.255.0

!

interface Vlan30

no nameif

security-level 100

ip address 172.16.1.21 255.255.255.224

!

object network INSIDE-NET

subnet 172.16.1.0 255.255.255.224

object network dmz-server

host 10.20.30.3

object network dmz-server2

host 10.20.30.2

!

route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

!

access-list icmp extended permit icmp any any

access-list OUTSIDE-DMZ extended permit ip any host 10.20.30.3

access-list OUTSIDE-DMZ extended permit ip any host 10.20.30.2

!

!

access-group icmp in interface outside

object network dmz-server

nat (dmz-zone,outside) static 205.0.1.1

object network dmz-server2

nat (dmz-zone,outside) static 205.0.1.2

!

!

!

!

class-map inspection-default

class-map icmp-class

match default-inspection-traffic

!

policy-map global-policy

class inspection-default

inspect icmp

policy-map icmp_policy

class icmp-class

inspect icmp

!

!

telnet timeout 5

ssh timeout 5

!

dhcpd auto_config outside

!

dhcpd enable

!

!

!

!

!

!

VIP Advisor RJI VIP Advisor
VIP Advisor

Re: Can't ping through ASA

Can you be more specific. What IP address are you pinging from and what IP address are you pinging?
You do not have a NAT defined for the internal network (172.16.1.x) were you expecting this traffic to be natted? Or does the next hop have a route back to the ASA for this traffic?
Beginner

Re: Can't ping through ASA

pinging from 204.0.1.0 network to the internal network which is the 172.16.1.0 network. Would setting up NAT for this solve this issue?

VIP Advisor RJI VIP Advisor
VIP Advisor

Re: Can't ping through ASA

So you are actually pinging from outside/external network to inside/internal, not the other way around. Obviously this is a packet tracer lab and not a production network, but is 172.16.1.0 network routable from the outside? Does the next hop of 204.0.1.0 know how to reach 172.16.1.0 network (are there routes define on each hop)? Or is nat required? In which case you'd need to define a static NAT.

Whatever device you are pinging on the 172.16.1.0 network, is it's default gateway the ASA?

View solution in original post

Beginner

Re: Can't ping through ASA

Setting up NAT has solved the issue. Thank you so much!

Beginner

Re: Can't ping through ASA

@Surtie16 Ohh Thank you so much for solving the issue. Hope to be more helpfull further.