Facing issues while ping across the FWSM & ASA

[shriprasad.rai]

Hi All,

I am observing a issue where am not able to ping couple of devices across the FWSM

The configuration permits ICMP from the source subnet (172.16.10.X/24) to the destination subnet (10.10.10.X/24)

But we are not able to ping host 10.10.10.12 from 172.16.10.X. We are able to ping 10.10.10.12 from the FWSM.

But we are able to ping host 10.10.10.13 from 172.16.10.X.

Am observing a similar issue in another setup across an ASA. Where am able to reach couple of devices but not able to reach one particlar device.

Please Advise.

Thanks!

[Jennifer Halim]

Have you enabled "inspect icmp" on both the FWSM and ASA?

Further to that, can you please share the security level of the interfaces that you are trying to ping to and from. Please also share the translation configuration as depending on the security level of the interfaces and where you are trying to ping from, you would need to configure different type of translation.

[shriprasad.rai]

Hi Jennifer,

The traffic flow is from lower Security Zone to Higher Security Zone

Traffic has been permitted in the ACL applied to the lower Security interface

ICMP inspection is not enabled

NAT has been disabled.

We are able to ping other machines in the same destination subnet from the same source subnet. Only one machine is not responding.

Thanks!

[Jennifer Halim]

If you are able to ping other destinations in the same subnet, it is likely to be the end host issue, not issue on the FWSM.

Pls kindly check if the end host which is not working has been configured with the same default gateway as the other hosts in the same subnet. Also if there is any personal firewall, etc enabled on the host, please check if it's allowing inbound access from other subnets. Most times if it is only issue with 1 host in the same subnet, it would be host issue, not configuration issue on the fwsm if you have generic subnet based translation and access-list to allow ping access.

[shriprasad.rai]

Hi Jennifer,

We thought the same way and informed the team managing the server to check on it. But they insist that nothing has been blocked. Also routes are proper on the end host. We are able to reach this machine from other subnets across the same Firewall. Hence checking on whether there is anything that needs to be checked on the FWSM.

Thanks!

[Jennifer Halim]

To prove and investigate where the issue might be, you can run packet capture on the FWSM on both the interfaces. Assuming that you are not translating any of the adddresses, then you can configure the following:

access-list cap-acl permit ip host 10.10.10.13 host 172.16.10.x
access-list cap-acl permit ip host 172.16.10.x host 10.10.10.13

Then apply the acl to both the interfaces:
cap cap-out access-list cap-acl interface
cap cap-in access-list cap-acl interface

Once you have configured the above, then pass the traffic through the fwsm, and check the packet capture and see where it's failing:

show cap cap-out

show cap cap-in

[shriprasad.rai]

Hi Jennifer,

I enabled packet capture on both inbound and outbound interfaces. I saw icmp packet entering the inbound interface but cant see the icmp packet exiting the outbound interface on the FWSM. Please advice. Thanks!

[shriprasad.rai]

Hi Jennifer,

Here are some logs for refernece. From 172.16.10.10 we are able to ping 10.10.10.13 and same is not possible with 10.10.10.12. ICMP Traffic coming from 172.16.10.10 on VLAN 120 is able to pass it to VLAN 10. Where as 10.10.10.13 it is able to pass the traffic.

802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.12: icmp: echo request
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.12: icmp: echo request
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.12: icmp: echo request
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.12: icmp: echo request
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 10.10.10.13 > 172.16.10.10: icmp: echo reply
802.1Q vlan#120 P0 10.10.10.13 > 172.16.10.10: icmp: echo reply
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 10.10.10.13 > 172.16.10.10: icmp: echo reply
802.1Q vlan#120 P0 10.10.10.13 > 172.16.10.10: icmp: echo reply
802.1Q vlan#120 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 172.16.10.10 > 10.10.10.13: icmp: echo request
802.1Q vlan#10 P0 10.10.10.13 > 172.16.10.10: icmp: echo reply

Thanks!

[Jennifer Halim]

This sounds like something that needs to be investigated further. Pls kindly open a TAC case so an engineer can troubleshoot the issue live with you.

[shriprasad.rai]

Hi Jennifer,

Thanks for your inputs