Devices unable to reach the Internet

[jf1134]

I need so help trying to figure out a problem that I am having.. I have a switch connected to my ASA.. From the ASA I can get out to the internet and I can ping the internal switch. From the switch I can ping the internal IP of the ASA but I can't ping 8.8.8.8

On the ASA I have a route: route outside 0.0.0.0 0.0.0.0 50.242.252.134 1 

On the Switch I have a route: ip route 0.0.0.0 0.0.0.0 172.16.128.2

I can't figure out what I am missing here in order for the switch to be able to get out to the internet

[Rob Ingram]

@jf1134 

Do you have NAT configured on the ASA for the network that the ping is sourced from?

If you do, do you have an ACL to permit icmp echo replies or MPF to inspect icmp? If not run "fixup protocol icmp" to allow icmp inspection.

If you are still having an issue run packet-tracer from the CLI and provide the output for review. E.g. - "packet-tracer input INSIDE icmp <source ip> 8 0 8.8.8.8"

[balaji.bandi · Accepted solution]

ASA by nature it blocks the Ping from inside.

Things required to check is the NAT enabled for the 172.16.128.x address

If the IP are different than  172.16.128.X then you need to route back from ASA to switch.

here is some guide : (ignore DMZ part)

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html

[jf1134]

I added that NAT rule from the document but still seeing the same thing. Can't get out to the internet. 

So I can ping the internal IP of the ASA from the switch now. I just can't get past the ASA

[Rob Ingram]

---

@Rob Ingram wrote:

If you do, do you have an ACL to permit icmp echo replies or MPF to inspect icmp? If not run "fixup protocol icmp" to allow icmp inspection.

If you are still having an issue run packet-tracer from the CLI and provide the output for review. E.g. - "packet-tracer input INSIDE icmp <source ip> 8 0 8.8.8.8"

---

Did you check what I suggested previously? ...because by default a ping won't be permitted until you either define an ACL or inspect icmp. Run the command "fixup protocol icmp" from the CLI.

If that doesn't work by running packet-tracer, will indicate what nat rule (if any) is being match and whether the traffic should be allowed/denied.

[jf1134]

It's working now.. I messed up the NAT rule the first time I did..