ASA inside interface - cannot ping it from a host on the same network

[Dean Brandt]

Hi there. I have an ASA with an inside interface 172.16.15.0/24. Behind that is a switch with the port configured in VLAN 1615 and the ASA connected to that port. A host is on the same VLAN with IP 172.16.15.10. Cannot ping the ASA interface from that host. Any attempt to get external also fails. Have also tried setting up a sub interface VLAN 1615 on the ASA, This stil fails re icmp / connectivity. Any ideas?

Thanks
Dean

[MHM Cisco World]

Can you share 

Capture traffic for inside interface of asa

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html

MHM

[Blue_Bird]

Hello Dean Brandt,

ASA firewall typically block all traffic by default. You probably need to explicitly allow icmp traffic and configure the asa to actually respond to that traffic, if you're trying to ping the firewall itself.

You need icmp to the inspection list by making sure that your global policy has icmp inspect enabled.

Also please share the configuration if possible...

Best regards
******* If This Helps, Please Rate *******

[balaji.bandi]

what is the ASA IP address - (can you post show run to look)

Is the Device having IP 172.16.15.10 - Gateway as ASA Inside IP address or Switch also have any IP address for VLAN 1615 ?

Lets start with basic config of ASA to get Device to ping ASA and able to get internet (before you make any other changes like sub-interface its not going to help here)

below basic config help you :

FW
===============
FW# show run
: Saved
:
: Serial Number: JMX1203L0NN
: Hardware: ASA5520, 2048 MB RAM, CPU Pentium II 1000 MHz
:
ASA Version 9.1(5)16
!
hostname FW
enable password 8Ry2YjIyt7RRXU24 encrypted
!
interface Ethernet0
nameif ISP1
security-level 0
ip address 10.10.10.2 255.255.255.0
!
interface Ethernet3
nameif LAN
security-level 100
ip address 192.168.13.1 255.255.255.0
!
ftp mode passive
object network LAN_Network
subnet 192.168.13.0 255.255.255.0
access-list LAN_access_in extended permit ip any any
access-list ISP1_access_in extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging buffered debugging
mtu ISP1 1500
mtu LAN 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network LAN_Network
nat (LAN,ISP1) dynamic interface
access-group LAN_access_in in interface LAN
route ISP1 0.0.0.0 0.0.0.0 10.10.10.1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
!
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
anyconnect-essentials
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global

[Marius Gunnerud]

In addition to the suggestions from others, could you provide a network diagram of the setup?

Are you using subinterfaces on the ASA and if yes, is the 172.16.15.0/24 interface configured for VLAN 1615?

How is the switchport the ASA is connected to configured (trunk / access)?

Have you verified that the DHCP scope is correct with regard to the subnet? i.e. is the DHCP scope providing a /24 subnet and not /23

Is VLAN1615 created on the switch or switches in the LAN?

Is the switchport connected to the PC in VLAN 1615?

If you have more than 1 switch in the LAN, verify which switch is the spanning-tree root for VLAN 1615.

[Aref Alsouqi]

If you have configured a subinterface on the ASA tagged with VLAN1615 then the switch port where the ASA interface is connected must be configured as a trunk port and VLAN1615 must be allowed on it. VLAN1615 in this case must not be configured as the native VLAN on the switch port. However, if you configured the ASA physical interface then the switch port where the ASA is connected must be configured as an access port in VLAN1615.

With regard to pings destined to the firewall itself you can check on the ASA if ping is allowed to the inside interface by using the command "show run icmp". If you should see a deny statement towards the inside interface then you have to add an allow statement above that deny statement. To do so, you can remove the deny statement, place the allow statement and then readd the deny statement as there is no other way to do so as far as I know.

However, for the transit pings that are passing through the ASA you would need to check if there is any access list applied to the inside interface, if there is any, ICMP echo requests should be allowed. Also, icmp inspection should be added to the ASA global policy map as follows:

policy-map global_policy
   class inspection_default
      inspect icmp