ASA and ICMP ACLs

[robert.horrigan]

Hello ASA-Gurus,

   I believe my ignorance is going to shine in this post but any help of my problem would be most appreciated.  I've deployed a number of ASA firewalls and I've come to find that ICMP seems to act differently on each implementation.  Sometimes I only need to allow ICMP inbound from the inside interface and the internal clients can ping the servers just fine.  Other times I have to allow ICMP both in and outbound in order for the clients to be able to ping the servers (as the firewall drops the server's reply traffic without the acl on the outside interface).  Am I going crazy here or do the differenet versions of ASA OS work differently?  Is there a setting that I can enable that will allow me to only have to apply the ICMP ACL on the inbound interface?

/r

Rob

[mirober2 · Accepted solution]

Hi Rob,

The answer to your question here is ICMP inspection. When ICMP inspection is disabled, pings are treated as 2 separate flows (one for the echo request and one for the echo reply). This is because ICMP traffic is treated as stateless by default (i.e. we don't track the request and response as a single flow). The inspection is disabled by default on the ASA, so you need to permit both the echo request and echo reply in the ACLs.

When ICMP inspection is enabled, the ASA treats the ICMP traffic as a unique connection. Therefore, when an echo request is seen, the ASA will open a pinhole in the ACL for the return echo reply.

You can enable the ICMP inspection with the following commands:

policy-map global_policy
   class inspection_default
      inspect icmp
service-policy global_policy global

Hope that helps.

-Mike

[robert.horrigan]

Got it, thanks a lot for the information.