Cisco ASA Public Interface

[maileh]

Hi 

Is it possible to access from a network behind a Cisco ASA Firewall Lan Interface to its own public IP Interface.

Eg 

User 10.1.1.100/24 ------------10.1.1.1/24 : LAN FW PUB : 1.1.1.1/32

Is it possible that the user (10.1.1.100) can access to ip 1.1.1.1 of the ASA Public Interface.

[Troy Jackson]

No it’s not possible. The ASA will not allow you to reach it’s own interface through the device.

[maileh]

Hi Troy

Thanks for your confirmation. Yes thats right and that is what i am experiencing.

I also work with Huawei UDEMON FW which they allowed.

Its really interesting to know why ?

[hslai]

The usage guidelines @ icmp -- import webvpn webcontent states,

...

The ASA only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.

... 

---

It's probably due to routing in a stateful firewall, such as ASA.

For network troubleshooting, we may ping another device either in the same public subnet or further upstream.