Default Configuration ASA 5510 is totally Missing Global-Policy

[Caleb Hubbartt]

ASA 5510 running 8.4(7), ASDM 7.1(1)

This is the first time I have seen this but it appears that the Global-Policy inspection map is not there at all in the default factory reset configuration. In all my past experiences with ASA this is preconfigured on the default startup config. It appears that there is a wizard I can run under "service policy objects" in ASDM but I'm not sure I want to do that if I don't have to. This particular ASA is being used in a very "walled off" scenario with a whitelist of allowed IP networks so I'm not really sure if I want to enable inspection if I don't have to. This is not really protecting web servers or inside hosts to the internet so the simpler I can keep the config the better. 

At the root of this I'm trying to configure to allow ping and traceroute through the ASA, which I know how to do and is part of my editing the default global policy in the the standard configuration. I do this for all my ASAs but this is throwing me a loop. If the global-policy is not there is it still doing its inspection? It doesn't appear to be allowing Trace Route back through the ASA.

WC-ASA# show run policy-map
WC-ASA#  

[mikael.lahtela]

Hi,

I have seen this sometimes that the global policy is missing.
And I don't think your icmp will work as expected if you are missing the global policy.
You have two options, add global policy with icmp inspect or open firewall rules for icmp.

Here is a icmp object to work with:
object-group icmp-type icmp_types_allowed
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
icmp-object unreachable

br, Micke

[Karsten Iwen]

You are right. This is missing if you completely erase the config. Instead of doing a "write erase" you could do a "configure factory-default" from global config mode to erase the config and get the default applied. The default policy is also documented here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/inspect_overview.html#pgfId-1536127