Can't Ping ASA different interfaces

[Jayesh Rajan]

                   We are using Cisco ASA 5580 (8.2) firewall. When i try to ping from inside lan to firewall DMZ interface IP it is not pingable and but from inside users i am able to ping firewall inside interface IP address.

I think we can't ping to other interfaces of ASA by default. But can we allow the single IP address who can ping all the interfaces of firewall?

We are not doing any natting in firewall, for that we used the Load Balancer.

Thanks...

[Julio Carvajal]

Hello Jayesh,

The ASA as a security device will not allow you to ping  a distant interface....

What is a distant interface?

As an example imagine you are on a host behind the inside interface.. You will be able to ping the inside interface but you wil NOT be able to ping the DMZ or outside interface... This because they are distant interface for the inside host..

There is nothing you can do to change that behavior, this is done as a security meassure by the ASA ( Built-in feature)

Regards,

Do rate all the helpful posts

Julio

[jong_r0602]

Hi Jayesh,

Julio is right that pingis not allowed by default. But you can still allow the PING by allowing ICMP in your access-list DMZ for specific host. You need also to allow ICMP from DMZ inteface.

ASA(config)# icmp permit host xxxx echo DMZ

ASA(config)# access-list DMZ-In extended permit icmp xxxx(DMZ host) host yyyy(inside host)

Thanks,

Jong

[Julio Carvajal]

Hello Jong,

I think he is refering to ping the DMZ interface from the inside.

Regards,

[jong_r0602]

Hi Julio,

      Oh yes.. its the interface and not the host. Your correct, ping is not allowed for this scenario.

Regards,

Jong

[Julio Carvajal]

Hello Jong,

Yep, that is right.

Have a good one!

Julio

[Jayesh Rajan]

Thanks All....

Is there any cisco document is available where this mentioned?

[nkarthikeyan]

Yes. Pls refer the below cisco document.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic0