Re: Ping only works in one direction - Cisco ASA 5506-X

Supasp · ‎02-12-2019

Hi everyone!

I have two hosts:

192.168.1.227 <--> outside (static 192.168.1.2)

192.168.2.230 <--> inside_1 (static 192.168.2.1)

I can ping sucessfully from 192.168.1.227 --> 192.168.2.230,

but not from 192.168.2.230 --> 192.168.1.227 (timeout).

My configuration:

: Serial Number: JAD223000VX
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
: Written by enable_15 at 15:03:52.549 UTC Tue Feb 12 2019
!
ASA Version 9.8(2) 
!
hostname ciscoasa
enable password $sha512$5000$BOpTSSo8HMFL8hZMk1Q8Ug==$S+zhKxWHBuw20kILyhW1kQ== pbkdf2
names

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address 192.168.1.2 255.255.255.0 
!
interface GigabitEthernet1/2
 nameif inside_1
 security-level 0
 ip address 192.168.2.1 255.255.255.0 
!
interface GigabitEthernet1/3
 nameif inside_2
 security-level 100
 ip address 192.168.3.4 255.255.255.0 
!
interface GigabitEthernet1/4
 shutdown
 nameif inside_3
 security-level 100
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 nameif inside_4
 security-level 100
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 nameif inside_5
 security-level 100
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 nameif inside_6
 security-level 100
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 nameif inside_7
 security-level 100
 no ip address
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
object network obj_any1
 subnet 0.0.0.0 0.0.0.0
object network obj_any2
 subnet 0.0.0.0 0.0.0.0
object network obj_any3
 subnet 0.0.0.0 0.0.0.0
object network obj_any4
 subnet 0.0.0.0 0.0.0.0
object network obj_any5
 subnet 0.0.0.0 0.0.0.0
object network obj_any6
 subnet 0.0.0.0 0.0.0.0
object network obj_any7
 subnet 0.0.0.0 0.0.0.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside_1 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 10 burst-size 10
icmp permit any outside
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit any time-exceeded outside
icmp permit any unreachable outside
icmp permit any inside_1
icmp permit any echo inside_1
icmp permit any echo-reply inside_1
icmp permit any time-exceeded inside_1
icmp permit any unreachable inside_1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.3.0 255.255.255.0 inside_2
http 192.168.2.0 255.255.255.0 inside_1
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.2.0 255.255.255.0 inside_1
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:fe1c9b29d70c67665e24ff9f0a68525e

What can I do to make this work?

Thanks!

Supasp · ‎02-12-2019

I just found: Ping in one way only

And the solution was configurating the Firewall on host 192.168.1.227.

Thanks for the attention.

Sergey Lisitsin · ‎02-12-2019

Supasp,

It looks like a host firewall issue. As your interfaces have the same security level and there are no ACLs applied to them, the traffic should flow equally in both directions. As it does in one direction, but not in the other, I think it is host related.

Jaderson Pessoa · ‎02-12-2019

Dear supasp, check if windows's firewall in client host is enable. If enabled, disabled it to test your connection, in case of sucessfuly you can enable again e create a rule to allow icmp from it.

Jaderson Pessoa
*** Rate All Helpful Responses ***