ASA5506 Access Question

[bwn]

We have an ASA5506 and I'm trying to have an IP address that is accessible on the outside interface be accessible on the inside interface. I can ping the address if I select outside interface but there is no response when trying to ping from the inside interface. I'm using the ASDM tool as I don't spend a lot of time managing routers. I tried changing the security level of the outside interface to 100 to match the inside interface as I thought traffic may be allowed if the same security level but that didn't seem to make a difference. 

[Flavio Miranda]

Hi @bwn 

 If you can keep the same security level, use the command

same-security-traffic permit inter-interface

[bwn]

I have done that as you can see in the screenshot attached. I've also set the security level the same. If I do a tracert from the outside interface it works fine but when I change to the inside_1 interface it hangs. 

[Rob Ingram]

@bwn for ICMP you either need to explictly permit ICMP echo-reply inbound on the outside interface ACL or as @MHM Cisco World mentioned enable ICMP inspection. Enable ICMP inspection using the CLI command fixup protocol icmp

To allow traceroute from inside to outside then you need to permit icmp time-exceeded and unreachable inbound on the outsisde interface ACL. Example https://integratingit.wordpress.com/2018/12/15/allow-icmp-traceroute-through-cisco-asa/

Also change the security level of the outside interface to 0, traffic from a low security level to a high level is denied as default (which is what you want on the outside interface).

[bwn]

I've changed the outside security back to 0. Is this where I should be permitting the ICMP echo reply? Is there anywhere I need to add anything?

[MHM Cisco World]

asa# packet-tracer input inside icmp x.x.x.x 8 0 y.y.y.y detail

x.x.x.x is inside subnet 

[MHM Cisco World]

1- icmp inspection 

2-allow icmp via inside acl if found 

3- route OUT 0.0.0.0 0.0.0.0 must add to asa