Solved: ASA 9.1(2) drops PING (icmp codes 0 & 8)

12oclock12 · ‎07-27-2015

Hi

Im trying to ping DMZ interface on ASA from INSIDE host and vise versa. It does not work :( Tried to debug icmp however the icmp packet did not even hit the DMZ interface from the particular host. Doing this with packet-tracer, ASA shows all results as ALLOW. Could one explain me how to permit a host placed in interface X to PING interface Y itself?

Thanks a lot beforehand!

NB

Attached is the packet-tracer result. What I'm trying to do is to ping DMZ interface (192.168.200.1) from INSIDE host (192.168.100.10).

Karsten Iwen · ‎07-27-2015

Works as designed. The ASA doesn't support pinging a foreign Address. If your ping-host is on the inside interface, you only can ping the inside IP, if your ping-host is in the DMZ, you only can ping the DMZ-IP. The ASA handles this differently then a router.

The only exception is with the "management-access XXX" command when the ping comes through a tunnel.

View solution in original post

Karsten Iwen · ‎07-27-2015

You should take the interface states from SNMP instead from pinging.

I don't think that twice-NAT is of much help here. And if it would be, your deployment would get more complex then needed.

If your system can't do anything other then ping, perhaps pinging a system connected to the other interface is of help? If that one responds, you know at least that the ASA interface has to be up. Well, that's not really a solution ... First try to make it work with SNMP.

View solution in original post

Karsten Iwen · ‎07-27-2015

Works as designed. The ASA doesn't support pinging a foreign Address. If your ping-host is on the inside interface, you only can ping the inside IP, if your ping-host is in the DMZ, you only can ping the DMZ-IP. The ASA handles this differently then a router.

The only exception is with the "management-access XXX" command when the ping comes through a tunnel.

12oclock12 · ‎07-27-2015

Thank you Karsten for your quick reply. Well, that is a pity though specially if you intend to use a DMZ "free linux systems" monitoring system checking interfaces via snmp however many of these systems need icmp interface check to see up/down state.

Perhaps I could try using twice-NAT? Or this won't even help me according to what you have said "FW ios design" ??

Karsten Iwen · ‎07-27-2015

You should take the interface states from SNMP instead from pinging.

I don't think that twice-NAT is of much help here. And if it would be, your deployment would get more complex then needed.

If your system can't do anything other then ping, perhaps pinging a system connected to the other interface is of help? If that one responds, you know at least that the ASA interface has to be up. Well, that's not really a solution ... First try to make it work with SNMP.

12oclock12 · ‎07-27-2015

Indeed. That's what I thought (snmp is working just fine). Will leave ICMP to hosts only behind interface respectively. Thanks a lot for your help! Appreciate it :)

Karsten Iwen · ‎07-27-2015

You are welcome! Come back to the Support-Community anytime again. ;-)