03-16-2022 04:15 AM - edited 03-17-2022 04:42 PM
Hello all,
I am having an issue with ASA5505 firewall setup. We have plenty of interfaces which works fine (likely same configurations, likely same ACL's as letting interface hosts reach required points)
I am able to ping 3 different devices from ASA with their interfaces but I am able only able to ping 2 of them from Core switch. Core switch has the route for ASA inside interface.
The log says "Deny inbound icmp src inside:core-switch dst interfaceM:IP-hostM(type 8, code 0)"
Any ideas as I am lost where this specific interfaceM doesn't work but others works as normal.
Thanks
03-16-2022 04:18 AM
@Orcun Colakoglu do you mean you are connected to the core switch and you are pinging the individual ASA interfaces? That won't work, by design, you can only ping the ASA's interface you (the core switch) is directly behind. You cannot ping through the ASA to one of the ASA's far interfaces.
03-16-2022 04:24 AM - edited 03-16-2022 04:26 AM
Hello @Rob Ingram , thanks for the reply.
Yes, I can't ping 3 ASA interfaces which my hosts are inside from Core-Switch which is normal as you mention.
Inside ASA, we have multiple interfaces and when I try to ping hosts which are under same interfaces, I can ping them.
Inside Core-Switch, we have same vlans, only vlan looking to ASA inside interface has IP address for management and ip routing is enabled. When I try to ping same 3 hosts with source as core switch management vlan ip;
03-16-2022 04:30 AM
@Orcun Colakoglu note sure what you are saying, are you connected on the inside of one ASA interface and pinging another ASA interface? If yes, that won't work.
If no, provide configs of switch and ASA and information on what you are pinging and from where.
03-16-2022 04:38 AM - edited 03-17-2022 04:42 PM
-- wrong --
03-16-2022 05:01 AM
check the Native VLAN, are the source of ping is Native VLAN ?
try not use native VLAN with ASA, the ASA do not support in some case the untag frame.
03-16-2022 08:01 AM
This doesn't reflect any solution nor about the issue I am having.
03-16-2022 08:15 AM
you mention that you use trunk with ASA, are you use native VLAN of this trunk as sub interface in ASA?
03-16-2022 09:01 AM - edited 03-17-2022 04:41 PM
After making some ACL changes, I am now gettin below error;
6 Mar 16 2022 07:45:27 302021 core-switch 0 IP-hostM 0 Teardown ICMP connection for faddr core-switch/0 gaddr IP-hostM/0 laddr IP-hostM/0 type 8 code 0
As I don't have access to hostM device, I believe hostM device has configuration which prevents other networks traffic by firewall or software. Could it be?
03-16-2022 09:13 AM
https://www.petenetlive.com/KB/Article/0000914
ICMP inspect default must enable.
03-16-2022 09:28 AM
@MHM Cisco Worldit is enabled.
I believe you missed the part that I can ping other hosts hostP, hostS and hostM normally inside from ASA and can't ping hostM from CoreSwitch but can ping hostP and hostS. Thanks.
03-16-2022 09:41 AM
Ping from ASA inside interface to all host is ok
Ping from core to any host is drop?
03-16-2022 09:54 AM
From ASA, I can ping hostS, hostP, hostM.
From CoreSwitch, I can ping hostS and hostP but can't ping hostM.
03-16-2022 10:27 AM
before I want to make you note that ASA have two ICMP check mode
the ICMP PASS THROUGH ASA different than ICMP FROM ASA.
there are two policy drop the traffic,
the security level which is default behavior for ASA
if the traffic go from High to low security level here the ICMP inspect work and traffic allow
what if we apply ACL in interface <-the interface that drop ICMP echo reply
the default behavior of ASA is change and now depend on ACL apply to interface.
so what should we do you must allow return Echo reply from interface to Core.
check if you have any ACL apply to this interface, then config it to allow echo reply.
03-16-2022 10:40 AM - edited 03-16-2022 10:44 AM
My inside interface has security-level 80 and CoreSwitch also belongs to this network.
Other interfaces InterfaceS, InterfaceP and InterfacesM has security-level 100
Below configurations are also in place;
For these 3 interfaces I don't have any echo-return ACL;
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide