cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7840
Views
0
Helpful
11
Replies

From Inside host unable to ping the ASA inside interface

mahesh18
Level 6
Level 6

Hi Everyone,

ASA inside interface has connection to switch.

ASA inside interface IP  192.168.1.1.

Switch Vlan 1 IP  192.168.1.2

Host PC  connected to switch IP 192.168.1.5

questions

From host PC  i can ping the internet but not IP 192.168.1.1?

Also from switch i can not ping 192.168.1.1 ?

is above issues is due to ASA  design or i am missing comething in my config?

Thanks

MAhesh

3 Accepted Solutions

Accepted Solutions

cadet alain
VIP Alumni
VIP Alumni

Hi,

it should be working by default, can you post your config.

Regards.

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

View solution in original post

You are denying icmp on the inside:

icmp deny any inside

remove that command and if the issue persists, try configuring the switch port as access for vlan 1.

Regards,

Felipe.

View solution in original post

Hi,

interface Vlan3

description DMZ to 3550DMZ

no forward interface Vlan1

nameif DMZ

security-level 50

ip address 192.168.12.2 255.255.255.0

This is Base Licence restriction:

3 active VLANs (3rd VLAN can initiate traffic to only one other VLAN).

So buy a Security plus licence and everything will be alright provided you configure an ACL to permit traffic from lower level to higher level.

Regards.

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

View solution in original post

11 Replies 11

cadet alain
VIP Alumni
VIP Alumni

Hi,

it should be working by default, can you post your config.

Regards.

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

Hi Alain,

Thanks for reply.

Currently i am away from ASA.

I will past the config today evening.

Thanks

Mahesh

lcambron
Level 3
Level 3

Mahesh,

With the configuration of the ASA and the switch port connecting to the ASA we should be able to help.

Also, clear the arp on the firewall, try to ping the switch and check if the ASA has an arp entry for 192.168.1.2

Regards,

Felipe.

Hi Alain and Felipe,

Here is config of ASA

ciscoasa# sh running-config

: Saved

:

ASA Version 8.2(5)

!

hostname ciscoasa

enable password PnBz02JMnfQN7Ggt encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 192.168.1.9 Mintoo

!

interface Ethernet0/0

description Connection to Outside Int fa0/3 of 3550B

switchport access vlan 2

!

interface Ethernet0/1

description Connection to Inside Int fa0/1 of 3550Inside

!

interface Ethernet0/2

description Connection to DMZ Int fa0/40 of 3550DMZ

switchport access vlan 3

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

description INSIDE to 3550Inside

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Vlan2

description OUTSIDE to 3550B

nameif outside

security-level 0

ip address 192.168.11.2 255.255.255.0

!

interface Vlan3

description DMZ to 3550DMZ

no forward interface Vlan1

nameif DMZ

security-level 50

ip address 192.168.12.2 255.255.255.0

!

banner motd

banner motd +-+

banner motd | |

banner motd | *** Unauthorized Use or Access Prohibited *** |

banner motd | |

banner motd | For Authorized Official Use Only |

banner motd | You must have explicit permission to access or |

banner motd | configure this device. All activities performed |

banner motd | on this device may be logged, and violations of |

banner motd | this policy may result in disciplinary action, and |

banner motd | may be reported to law enforcement authorities. |

banner motd | |

banner motd | There is no right to privacy on this device. |

banner motd | |

banner motd +-+

banner motd

banner motd

banner motd +-+

banner motd | |

boot system disk0:/asa825-k8.bin

ftp mode passive

clock timezone MST -7

clock summer-time MST recurring

access-list OUTSIDE_IN extended permit tcp host 192.168.11.1 host 192.168.12.1 eq telnet

pager lines 24

logging enable

logging timestamp

logging buffered informational

mtu inside 1500

mtu outside 1500

mtu DMZ 1500

icmp unreachable rate-limit 1 burst-size 1

icmp deny any inside

no asdm history enable

arp timeout 14400

access-group OUTSIDE_IN in interface outside

!

router ospf 1

network 192.168.1.0 255.255.255.0 area 0

network 192.168.11.0 255.255.255.0 area 0

network 192.168.12.0 255.255.255.0 area 0

log-adj-changes

!

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication serial console LOCAL

aaa authentication http console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 192.168.11.0 255.255.255.0 outside

ssh 192.168.0.0 255.255.0.0 outside

ssh timeout 60

ssh version 2

console timeout 0

dhcpd dns 4.2.2.2

!

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 192.168.11.1

webvpn

username mintoo password AILiHuRWFGgkbsI5 encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:ed0c14b97f28804194267c80a621cbca

: end

Switch port config connected to ASA

3550Inside#sh run int fa0/1

Building configuration...

Current configuration : 68 bytes

!

interface FastEthernet0/1

switchport mode dynamic desirable

end

Thanks

Mahesh

Hi,

Here is more update

ciscoasa# clear arp

ciscoasa# ping  192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)

ciscoasa# sh arp

        inside 192.168.1.2 000b.fd1c.0800 43

        outside 192.168.11.1 0009.e8a2.0080 31

        DMZ 192.168.12.1 0013.191d.ec80 18

ciscoasa#

You are denying icmp on the inside:

icmp deny any inside

remove that command and if the issue persists, try configuring the switch port as access for vlan 1.

Regards,

Felipe.

Hi Felipe,

It worked like charm i can ping from inside host to inside IP.

Other thing from Inside of DMZ  i can not ping inside host.

Is this blocked by design?

Many thanks

MAhesh

Hi,

interface Vlan3

description DMZ to 3550DMZ

no forward interface Vlan1

nameif DMZ

security-level 50

ip address 192.168.12.2 255.255.255.0

This is Base Licence restriction:

3 active VLANs (3rd VLAN can initiate traffic to only one other VLAN).

So buy a Security plus licence and everything will be alright provided you configure an ACL to permit traffic from lower level to higher level.

Regards.

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

Hi Alain,

Can you please tell what should i config  on ACL to allow traffic from lower to higer.

Thanks

MAhesh

Mahesh,

I'm glad it worked, make sure to mark the post as answered so that others can learn.

Regards,

Felipe.

Hi Felipe and Alain,

Many thanks for help.

Regards

MAhesh

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: