Firepower Ping

[Juraj Papic]

Hi all,

I my firewall (Firewpower) in the G0/0 I configured the interface 192.168.100.250/24, this is directly connected do my router 192.168.100.245/24 , from the Firewall I can ping my interface but I cant ping the ip from the router, I also tried this from the expert mode and same issue.

Thanks in advance for any help.

[Flavio Miranda]

Hi

  Usually icmp is denied by default on firewall for security reason. You can permit it. Try to add this ACL and apply it to the outside interface.

ASA(config)#access-list ACL-OUTSIDE extended permit icmp any any 
ASA(config)#access-group ACL-OUTSIDE in interface outside 

[Juraj Papic]

Hello,

This is a Firepower not the asa, I configure a Policy to permit any any.

thanks. 

[Rob Ingram]

@Juraj Papic by default you should be able to ping the Firepower device.

What hardware appliance are you using?

Are you using FMC or FDM to manage the firewall?

Do you mean you can ping the Firewalls own IP address from the firewall itself?

...but you cannot ping to the router or do you mean you cannot ping from the router to the firewall?

[Juraj Papic]

Im usgin FMC to manage the firewll from the CLI I can ping my interface , but I cant ping the router connected to that interface, 

thanks. 

[Rob Ingram]

@Juraj Papic which interface have you configured, the data interface or the mgmt interface?

If using the data interface using ping <ip address> or if using the mgmt interface using ping system <ip address>

[Juraj Papic]

Im testing the ping to the G0/0 this is connected to my router, and I tryed both option ping IP and ping system IP, with both options I have no answer from the Router.

thanks.

[Rob Ingram]

@Juraj Papic what have you configured data and/or mgmt interfaces?

Provide the output of "show network" and "show interface ip brief" from the Firewall

And the configuration of the router interface that connects to the firewall.

[Juraj Papic]

I will sent it right now.

thanks.

[MHM Cisco World]

I one time see same case,

When we do packet tracer from one ip to any interface ip in asa, the asa refuse ping packet simply drop.

So are you use this interface ip for managment? 

[Juraj Papic]

No sir,, it not the Mgmt.

thanks. 

[Eric R. Jones]

Is ICMP disabled by default on outside interfaces?

[Juraj Papic]

This will be to the Inside Interface and I enabled a policy to accept any / any

[Sheraz.Salim]

curious could be cable issue on the router as they connected directly as you mentioned in your post.

[MHM Cisco World]

Are you config icmp inspection?