Cisco ASA 5506 multiple outside IP's allow ping

[Philip Curwen]

Hi all, I have a /28 subnet and have configured a couple public IPs with NAT for various services. The outside interface has a main IP address configured and I create NAT and access-lists for other public IPs in my subnet. All is working in that respect. I allow ping for testing purposes to the main public IP on the outside interface with:

access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any echo

And apply that to the outside interface. Ping however does not happen on my other public IPs in my subnet. How can I allow this?

Cheers

[Maykol Rojas]

Hello; 

This should work. Are you able to ping the real IP from the ASA firewall itself? Can you do a packet tracer using  the CLI and paste it over here? 

Mike. 

[Philip Curwen]

I can ping the real IP from the ASA but not the second one..

Real IP: A.A.A.A.A

Second IP: B.B.B.B

A.A.A.A.A

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Result:
input-interface: inside
input-status: up
input-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

B.B.B.B.B

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop B.B.B.B.B using egress ifc outside

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[gaowen]

Do the services work on all the servers you have configured in your DMZ?

It looks like your NAT isn't properly configured and your ASA is responding to pings, not the device which you should be NATing to. If your NAT is properly configured then remember you'll need a route on to your internal services on your ASA