icmp deny any inside on ASA

[mahesh18]

Hi Everyone,

I applied this on ASA

icmp deny any inside

After applying this

1>From ASA  i can ping the inside interface IP

ciscoasa# ping 192.168.1.1 *********************************************************************************************Inside Interface

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

I can ping the outside IP

ciscoasa# ping 4.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/54/60 ms

ciscoasa#

2>From PC connected to ASA   i can not ping the inside interface but i can pint the internet sites.

Need to understand why from PC  i can not ping the ASA inside IP  but i can ping internet sites?

Thanks

Mahesh

[Karsten Iwen · Accepted solution]

You are using the wrong command to achieve your goals.

The icmp-command controlls what type of icmp-messages the attached PCs can send *to* the ASA. As you have a deny in the rule the ping doesn't work.

Access-Lists control what can be sent *through* the ASA. You have to add a line "deny icmp any any" to the ACL on your inside interface. If you don't have an ACL yet, then you need a second line "permit ip any any" to allow the rest.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Jennifer Halim · Accepted solution]

1. The "icmp deny any inside" command allows you to block ping towards the ASA inside interface. So you won't be able to ping the inside interface of the ASA from a host connected to the internal network. You can't test to ping it from the ASA itself as it is meant to be from hosts behind the inside interface.

2. That "icmp deny any inside" command only to allow or block ping towards the ASA interfaces, not ping through the ASA. If you are trying to ping the internet sites and want to block those, then you would need to configure interface access-list to block it and apply it with access-group command on the interface.

Hope that helps.

[mahesh18]

Hi Karsten and Jennifer,

So explained the concept very well.

Many thanks again

Regards

Mahesh

[Karsten Iwen · Accepted solution]

And if you now plan your config, remember that ICMP is not your enemy. ICMP has also some useful features like unreachables that should be allowed in many cases.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni