ASA: Not getting Internet Access on the Server.

[vikrammurudkar7589]

Hi All,

I'm currently having issue where the System Admin is having difficulty in getting internet access. A rule was created on the Cisco ASA to allow internet access to the Server but the System Admin is not getting internet access but when we do the testing with the packet-tracer command using both the icmp & tcp; it was showing all allowed.

But, when did the packet capture on the ASA, we're able to see the icmp echo-request but not the icmp echo-reply in both capin & capout.

What can be the reason for this? Can anyone tell what can be the reason for this?

Thanks & Regards,

Vikram Murudkar.

[Karsten Iwen]

Often enough it is a destination that just does not answer on Pings. Have you tested real traffic?

For ICMP, did you enable the inspection on the ASA?

[Marvin Rhoads]

Is there a static NAT rule for the server in addition to the ACL entry?

Please share the relevant configuration commands you are using.

[John Hinckley]

I second what Karsten said.  If you don't have ICMP inspection turned on, you typically won't get replies without a permissive ACL.  You should also verify that you are allowing echo replies to the outside interface in the SSH config.