Deny ping on outside interface while allowing inside hosts to ping external hosts

[scotteberl]

Been wresting with this one for a bit not.

Running IOS 9.2 on a ASA5505

Can anyone tell me how I could accomplish this? I know how to disable ping on the outside interface using icmp deny any outside but then when I try to ping an external ip the replies seem to never come back.

[ghostinthenet]

Denying ICMP packets wholesale isn't a practice I recommend, only because you're disabling essential control packets along with ping requests. Instead of turning it off with "icmp deny any outside", try putting something like "deny icmp any any echo" in the ACL for your outside interface. This will prevent external ping traffic, but allow other ICMP to pass... including replies to ping requests generated by internal devices.

[scotteberl]

Thanks for the reply Jody. I ended up getting it working using the following configuration items:

icmp permit any echo-reply OUTSIDE
icmp deny any echo OUTSIDE

[ghostinthenet]

That will work, too.

Also, it's best to make sure you're permitting all of the other ICMP types other than echo so that you don't lose control functions like path mtu discovery, network unreachable, traceroute, &c.

[scotteberl]

So you don't see allowing ping to the outside interface of the ASA as a security concern?

[ghostinthenet]

Personally, no... but that's up to you.

What I'm saying is that even if you are blocking pings to your ASA, you should make sure that other ICMP traffic is permitted in. These are used for various Internet control functions and you're potentially limiting functionality and troubleshooting capabilities by blocking them.