icmp deny any outside

[estelamathew]

Hello Dears,

When i apply this command icmp deny any outside it is blocking everything from outside even though tcp and udp  why ???,

I have a permit access-list for my DMZ servers on TCP and UDP  but they are blocked once i apply the icmp deny any outside command.

Thanks

[Shrikant Sundaresh]

Hi Estela,

Could you please apply captures on the outside interface and see if traffic is actually reaching the ASA?

I am just wondering(very unlikely) if the device connected on the outside of the ASA, is using icmp to determine if ASA is available.

Secondly if you do a packet-tracer command for one of the DMZ servers, it would clarify what  the problem is:

packet-tracer input outside tcp 4.2.2.2 4222 det

Assuming, "outside" is the name of your outside interface, and the server you are testing connectivity to, provides a tcp service.

If any of the phases in the resulting output, show a "drop", that would point to where the issue is.

In case you need any help with the output, then please attach a sanitized config, and the output of the packet tracer command as well.

-Shrikant