Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Firewalls Community


Ping only works in one direction - Cisco ASA 5506-X

Hi everyone!


I have two hosts: <--> outside (static <--> inside_1 (static


I can ping sucessfully from -->,

but not from --> (timeout).


My configuration:

: Serial Number: JAD223000VX
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
: Written by enable_15 at 15:03:52.549 UTC Tue Feb 12 2019
ASA Version 9.8(2)
hostname ciscoasa
enable password $sha512$5000$BOpTSSo8HMFL8hZMk1Q8Ug==$S+zhKxWHBuw20kILyhW1kQ== pbkdf2

interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address
interface GigabitEthernet1/2
 nameif inside_1
 security-level 0
 ip address
interface GigabitEthernet1/3
 nameif inside_2
 security-level 100
 ip address
interface GigabitEthernet1/4
 nameif inside_3
 security-level 100
 no ip address
interface GigabitEthernet1/5
 nameif inside_4
 security-level 100
 no ip address
interface GigabitEthernet1/6
 nameif inside_5
 security-level 100
 no ip address
interface GigabitEthernet1/7
 nameif inside_6
 security-level 100
 no ip address
interface GigabitEthernet1/8
 nameif inside_7
 security-level 100
 no ip address
interface Management1/1
 no nameif
 no security-level
 no ip address
ftp mode passive
same-security-traffic permit inter-interface
object network obj_any1
object network obj_any2
object network obj_any3
object network obj_any4
object network obj_any5
object network obj_any6
object network obj_any7
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside_1 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 10 burst-size 10
icmp permit any outside
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit any time-exceeded outside
icmp permit any unreachable outside
icmp permit any inside_1
icmp permit any echo inside_1
icmp permit any echo-reply inside_1
icmp permit any time-exceeded inside_1
icmp permit any unreachable inside_1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http inside_2
http inside_1
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh inside_1
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect icmp error
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous

What can I do to make this work?



Re: Ping only works in one direction - Cisco ASA 5506-X

I just found: Ping in one way only

And the solution was configurating the Firewall on host

Thanks for the attention.

Rising star

Re: Ping only works in one direction - Cisco ASA 5506-X



It looks like a host firewall issue. As your interfaces have the same security level and there are no ACLs applied to them, the traffic should flow equally in both directions. As it does in one direction, but not in the other, I think it is host related.

Rising star

Re: Ping only works in one direction - Cisco ASA 5506-X

Dear supasp, check if windows's firewall in client host is enable. If enabled, disabled it to test your connection, in case of sucessfuly you can enable again e create a rule to allow icmp from it.
Jaderson Pessoa
*** Rate All Helpful Responses ***