12-16-2020 04:39 AM
I have a Cisco ASAv connected with 2 c7200 routers in gns3, connected with inside interface and the other connected outside.
The ip of interface inside is 11.0.1.1/24 and the ip of interface outside is 12.0.1.1/24
Below is the ip of c7200 interface connected to ASAv inside interface
FastEthernet0/0 11.0.1.2 YES NVRAM up up
Below is the ip of c7200 interface connected to ASAv outside interface
FastEthernet0/0 12.0.1.2 YES NVRAM up up
Below is the interface configuration of ASAv interfaces
ciscoasa# show running-config interface
!
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 11.0.1.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif outside
security-level 0
ip address 12.0.1.1 255.255.255.0
!
I have configured OSPF discovery from all the 3 devices.
ciscoasa# show running-config router
router ospf 1
router-id 11.11.12.12
network 11.0.1.0 255.255.255.0 area 0
network 12.0.1.0 255.255.255.0 area 0
log-adj-changes
!
And also configured acl in ASAv
ciscoasa# show running-config access-group
access-group in2out in interface inside
access-group in2out out interface inside
ciscoasa# show running-config access-list
access-list out2in extended permit icmp any any
But when I ping from the 12.0.1.1 which is outside interface ip of ASAv from c7200 device which is connected to the inside interface of ASAv the ping does not work.
But the ping does work to the device connected to the outside interface which is 12.0.1.2 which is the c7200 connected from it.
Can someone suggest why the ping is not working here?
Thanks in Advance,
Mohammed Fazil
Solved! Go to Solution.
12-16-2020 04:48 AM
You cannot be connected on one ASA interface (inside) and ping through the ASA to one of the ASA's far interfaces (outside), this will not work by design. You should test connectivity by pinging through the ASA to another device, you would of course either need to inspect icmp or permit the return icmp traffic.
HTH
12-16-2020 04:48 AM
You cannot be connected on one ASA interface (inside) and ping through the ASA to one of the ASA's far interfaces (outside), this will not work by design. You should test connectivity by pinging through the ASA to another device, you would of course either need to inspect icmp or permit the return icmp traffic.
HTH
12-16-2020 11:54 PM
Hi Rob,
Thanks a lot! for your reply.
Got the understanding.
Thanks and Regards,
Mohammed Fazil
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide