Enable Ping interface WAN (Firepower FMC)

[FranciscoOpenLink]

Hello, I am trying to ping the WAN interface of a Firepower in a laboratory and it blocks the traffic.

I have another firepower but this one is not added to the FMC and the ping works without problem, I already enabled the ping in the FMC and created a rule that allows everything and it doesn't work.

[Rob Ingram]

@FranciscoOpenLink

Ping would be permitted as default to the FTD.

Where did you configure the ping rules? ICMP (ping) is controlled via the Platform Settings not the Access Control Policy (ACP).

Where are you pinging from?

What interface are you connected to?

You'd only be able to ping the WAN interface if you were connected behind that interface, you could not be connected behind another FTD interface (i.e., INSIDE) and ping the WAN interface, that will not work by design.

[FranciscoOpenLink]

Hello, I am pinging from another Firepower that I have connected via WAN on the same network segment.

I show you the rules I create

 

[FranciscoOpenLink]

connect a virtual machine to that interface to check and it doesn't work either.

[Rob Ingram]

@FranciscoOpenLink what is the configuration of the ICMP service "permitICMP"? if it's incorrect, there is an implicit deny, so the traffic will be dropped.

The ACP policy is not applicable when controlling traffic to the FTD's interface.

[FranciscoOpenLink]

I am allowing ICMP in that policy

[MHM Cisco World]

some times the PC OS FW drop ICMP, disable FW or allow ping.