Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1680
Views
0
Helpful
3
Replies

ICMP in and out of the same ASA 8.2 interface fails (ASA is Default Gateway)

mkmead
Level 4
Level 4

‎06-26-2020 11:55 AM

When I remotely ping from a remote network 192.168.210.x to a server (192.168.17.x) it fails.

1. I have already enabled "same-security-traffic permit inter-interface"
2. I have already a policy map to do TCP state bypass

 

the ASA logs show:

4Jun 26 202010:01:44313004    Denied ICMP type=0, from laddr 192.168.17.5 on interface inside to 192.168.210.153: no matching session

 

ASA1# packet-tracer input inside icmp 192.168.210.153 0 0 192.168.17.5

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.17.0 255.255.255.0 inside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit icmp any any
Additional Information:

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class
match any
policy-map WAAS
description HTTP
class global-class
inspect waas
service-policy WAAS global
Additional Information:

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class1
match default-inspection-traffic
policy-map WAAS
description HTTP
class global-class1
inspect icmp
service-policy WAAS global
Additional Information:

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT-EXEMPT
Subtype: rpf-check
Result: ALLOW
Config:
match ip inside 192.168.17.0 255.255.255.0 inside 192.168.0.0 255.255.0.0
NAT exempt
translate_hits = 405, untranslate_hits = 1
Additional Information:

Phase: 9
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside) 1 192.168.17.0 255.255.255.0
match ip inside 192.168.17.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 11
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 158763, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

 

ASA1# packet-tracer input inside icmp 192.168.17.5 0 0 192.168.210.153

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.0.0 255.255.0.0 inside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit icmp any any
Additional Information:

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class
match any
policy-map WAAS
description HTTP
class global-class
inspect waas
service-policy WAAS global
Additional Information:

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class1
match default-inspection-traffic
policy-map WAAS
description HTTP
class global-class1
inspect icmp
service-policy WAAS global
Additional Information:

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
match ip inside 192.168.17.0 255.255.255.0 inside 192.168.0.0 255.255.0.0
NAT exempt
translate_hits = 456, untranslate_hits = 1
Additional Information:

Phase: 9
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 192.168.17.0 255.255.255.0
match ip inside 192.168.17.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 10
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 192.168.17.0 255.255.255.0
match ip inside 192.168.17.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 11
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 158930, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

What might I be missing.

0 Helpful
3 Replies 3

Anupam Pavithran
Cisco Employee
Cisco Employee

‎06-27-2020 09:25 PM

Hi !

 

I see the ingress and egress interface is inside.

Try, "same-security-traffic permit intra-interface"

Also share the output of "packet-tracer input inside icmp 192.168.210.153 8 0 192.168.17.5 det"

 

Cheers,

Anupam

0 Helpful

mkmead
Level 4
Level 4
In response to Anupam Pavithran

‎06-29-2020 11:23 AM - edited ‎06-29-2020 11:24 AM

I tried adding the command. I did a test ping but it still fails. My machines IP is now .188

4Jun 29 202009:33:01313004    Denied ICMP type=0, from laddr 192.168.17.5 on interface inside to 192.168.210.188: no matching session


Below is the test.. I can probably retire that old WAAS policy we don't use it any longer.

ASA1(config)# same-security-traffic permit intra-interface
ASA1(config)# exit
ASA1# write mem


ASA1# packet-tracer input inside icmp 192.168.210.188 8 0 192.168.17.5 det

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.17.0 255.255.255.0 inside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit icmp any any
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc97328d8, priority=12, domain=permit, deny=false
hits=55680, user_data=0xc7959810, cs_id=0x0, flags=0x0, protocol=1
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9d35b70, priority=8, domain=conn-set, deny=false
hits=375444, user_data=0xc9d350b8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc96aa1f8, priority=0, domain=inspect-ip-options, deny=true
hits=467898, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class
match any
policy-map WAAS
description HTTP
class global-class
inspect waas
service-policy WAAS global
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9d2d9c0, priority=70, domain=inspect-waas, deny=false
hits=375445, user_data=0xc9d2d808, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map global-class1
match default-inspection-traffic
policy-map WAAS
description HTTP
class global-class1
inspect icmp
service-policy WAAS global
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9d31e50, priority=70, domain=inspect-icmp, deny=false
hits=55681, user_data=0xc9d31c50, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9d33620, priority=70, domain=inspect-icmp-error, deny=false
hits=55681, user_data=0xc9d33420, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 8
Type: NAT-EXEMPT
Subtype: rpf-check
Result: ALLOW
Config:
match ip inside 192.168.17.0 255.255.255.0 inside 192.168.0.0 255.255.0.0
NAT exempt
translate_hits = 62532, untranslate_hits = 3
Additional Information:
Forward Flow based lookup yields rule:
in id=0xca047f88, priority=6, domain=nat-exempt-reverse, deny=false
hits=3, user_data=0xca020968, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip=192.168.0.0, mask=255.255.0.0, port=0
dst ip=192.168.17.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 9
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xc9d35ea8, priority=8, domain=conn-set, deny=false
hits=114427, user_data=0xc9d350b8, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 10
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside) 1 192.168.17.0 255.255.255.0
match ip inside 192.168.17.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:
Forward Flow based lookup yields rule:
out id=0xc9ff1758, priority=1, domain=nat-reverse, deny=false
hits=3, user_data=0xca232f68, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=192.168.17.0, mask=255.255.255.0, port=0, dscp=0x0

Phase: 11
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 192.168.17.0 255.255.255.0
match ip inside 192.168.17.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:
Reverse Flow based lookup yields rule:
in id=0xc9ff17f0, priority=1, domain=host, deny=false
hits=286005, user_data=0xca232f68, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=192.168.17.0, mask=255.255.255.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0xc96aa1f8, priority=0, domain=inspect-ip-options, deny=true
hits=467900, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 13
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 448112, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

0 Helpful

mkmead
Level 4
Level 4
In response to mkmead

‎06-29-2020 11:27 AM

I got it working! LOL

So as soon as I got done typing, that the old WAAS policy could be removed. I went and removed it. Soon as I did that it started working. I am guessing that policy was messing with ICMP inspection and breaking it.

Thanks for your help! 

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card