Deny inbound icmp src inside:IP dst interface:IP

[Orcun Colakoglu]

Hello all,

I am having an issue with ASA5505 firewall setup. We have plenty of interfaces which works fine (likely same configurations, likely same ACL's as letting interface hosts reach required points)

I am able to ping 3 different devices from ASA with their interfaces but I am able only able to ping 2 of them from Core switch. Core switch has the route for ASA inside interface.

The log says "Deny inbound icmp src inside:core-switch dst interfaceM:IP-hostM(type 8, code 0)"

Any ideas as I am lost where this specific interfaceM doesn't work but others works as normal.

Thanks

[Rob Ingram]

@Orcun Colakoglu do you mean you are connected to the core switch and you are pinging the individual ASA interfaces? That won't work, by design, you can only ping the ASA's interface you (the core switch) is directly behind. You cannot ping through the ASA to one of the ASA's far interfaces.

[Orcun Colakoglu]

Hello @Rob Ingram , thanks for the reply.

Yes, I can't ping 3 ASA interfaces which my hosts are inside from Core-Switch which is normal as you mention.

Inside ASA, we have multiple interfaces and when I try to ping hosts which are under same interfaces, I can ping them.

Inside Core-Switch, we have same vlans, only vlan looking to ASA inside interface has IP address for management and ip routing is enabled. When I try to ping same 3 hosts with source as core switch management vlan ip;

• 2 of them responds normally
• 1 of them doesnt responds and drops and I see below log on ASA when I filter with source IP address of the host pinged;
  • "Deny inbound icmp src inside:core-switch dst interfaceM:xx.xxx.xxx.xx(type 8, code 0)"

[Rob Ingram]

@Orcun Colakoglu note sure what you are saying, are you connected on the inside of one ASA interface and pinging another ASA interface? If yes, that won't work.

If no, provide configs of switch and ASA and information on what you are pinging and from where.

[Orcun Colakoglu]

-- wrong --

[MHM Cisco World]

check the Native VLAN, are the source of ping is Native VLAN ?
try not use native VLAN with ASA, the ASA do not support in some case the untag frame.

[Orcun Colakoglu]

This doesn't reflect any solution nor about the issue I am having.

[MHM Cisco World]

you mention that you use trunk with ASA, are you use native VLAN of this trunk as sub interface in ASA?

[Orcun Colakoglu]

After making some ACL changes, I am now gettin below error;

6 Mar 16 2022 07:45:27 302021 core-switch 0 IP-hostM 0 Teardown ICMP connection for faddr core-switch/0 gaddr IP-hostM/0 laddr IP-hostM/0 type 8 code 0

As I don't have access to hostM device, I believe hostM device has configuration which prevents other networks traffic by firewall or software. Could it be?

[MHM Cisco World]

https://www.petenetlive.com/KB/Article/0000914

ICMP inspect default must enable.

[Orcun Colakoglu]

@MHM Cisco Worldit is enabled.

I believe you missed the part that I can ping other hosts hostP, hostS and hostM normally inside from ASA and can't ping hostM from CoreSwitch but can ping hostP and hostS. Thanks.

[MHM Cisco World]

Ping from ASA inside interface to all host is ok

Ping from core to any host is drop?

[Orcun Colakoglu]

From ASA, I can ping hostS, hostP, hostM.

From CoreSwitch, I can ping hostS and hostP but can't ping hostM.

[MHM Cisco World]

before I want to make you note that ASA have two ICMP check mode 
the ICMP PASS THROUGH ASA different than ICMP FROM ASA.

there are two policy drop the traffic,
the security level which is default behavior for ASA
if the traffic go from High to low security level here the ICMP inspect work and traffic allow 

what if we apply ACL in interface <-the interface that drop ICMP echo reply  
the default behavior of ASA is change and now depend on ACL apply to interface. 

so what should we do you must allow return Echo reply from interface to Core. 

check if you have any ACL apply to this interface, then config it to allow echo reply.

[Orcun Colakoglu]

My inside interface has security-level 80 and CoreSwitch also belongs to this network.

Other interfaces InterfaceS, InterfaceP and InterfacesM has security-level 100

Below configurations are also in place;

• same-security-traffic permit inter-interface
• same-security-traffic permit intra-interface
• policy-map global_policy
  • class inspection_default
    • inspect icmp
    • inspect icmp error

For these 3 interfaces I don't have any echo-return ACL;

• interfaceS and interfaceP responds to CoreSwitch ping requests
• interfaceM doesn't responds to CoreSwitch ping requests