Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
5186
Views
0
Helpful
9
Replies

ICMP/Ping Traffic Not being Allowed Through (ASA) Outside Interface

Colourful
Level 1
Level 1

‎11-13-2012 12:24 PM - edited ‎03-11-2019 05:23 PM

Hi , Any help would be appreciated. I am unable to ping external address, which are directly nating through to internal hosts (Internal hosts are pingable)

I have ICMP FIXUP enabled. See running config below.

      

ASA Version 8.2(5)26 <context>
!
hostname
names
name 10.96.4.18 DBServer01_INSIDE

name 109.228.40.132 DBServer01_OUTSIDE

name 194.105.64.0 Office
name 81.136.138.157 A1

name 217.41.66.241 A2
name 10.96.4.19 WebServer01_SSL01_INSIDE
name 109.228.40.133 WebServer01_SSL01_OUTSIDE
name 10.96.4.20 WebServer01_SSL02_INSIDE
name 109.228.40.134 WebServer01_SSL02_OUTSIDE
name 10.96.4.21 WebServer01_SSL03_INSIDE
name 109.228.40.135 WebServer01_SSL03_OUTSIDE
name 92.238.216.230 OfficeExternal
name 10.96.4.150 WebServer01_SSL04_INSIDE
name 109.228.40.136 WebServer01_SSL04_OUTSIDE
name 10.96.4.151 WebServer01_SSL05_INSIDE
name 109.228.40.137 WebServer01_SSL05_OUTSIDE
name 10.96.4.152 WebServer01_SSL06_INSIDE
name 109.228.40.138 WebServer01_SSL06_OUTSIDE
name 10.96.4.153 WebServer01_SSL07_INSIDE
name 109.228.40.139 WebServer01_SSL07_OUTSIDE
name 10.96.4.154 WebServer01_SSL08_INSIDE
name 109.228.40.140 WebServer01_SSL08_OUTSIDE
name 10.96.4.155 WebServer01_SSL09_INSIDE
name 109.228.40.141 WebServer01_SSL09_OUTSIDE
name 10.96.4.156 WebServer01_SSL10_INSIDE
name 109.228.40.142 WebServer01_SSL10_OUTSIDE
name 10.96.4.157 WebServer01_SSL11_INSIDE
name 109.228.40.143 WebServer01_SSL11_OUTSIDE
name 10.96.4.158 WebServer01_SSL12_INSIDE
name 109.228.40.144 WebServer01_SSL12_OUTSIDE
name 10.96.4.159 WebServer01_SSL13_INSIDE
name 109.228.40.145 WebServer01_SSL13_OUTSIDE
name 217.174.252.254 TEMP_MRCOOL
name 88.208.249.143 TEMP_MRWIBBLE
name 109.228.40.146 WebServer01_SSL14_OUTSIDE
name 109.228.40.147 WebServer01_SSL15_OUTSIDE
name 109.228.40.148 WebServer01_SSL16_OUTSIDE
name 109.228.40.149 WebServer01_SSL17_OUTSIDE
name 109.228.40.150 WebServer01_SSL18_OUTSIDE
name 109.228.40.151 WebServer01_SSL19_OUTSIDE
name 109.228.40.152 WebServer01_SSL20_OUTSIDE
name 109.228.40.153 WebServer01_SSL21_OUTSIDE
name 109.228.40.154 WebServer01_SSL22_OUTSIDE
name 109.228.40.155 WebServer01_SSL23_OUTSIDE
name 109.228.40.156 WebServer01_SSL24_OUTSIDE
name 109.228.40.157 WebServer01_SSL25_OUTSIDE
name 109.228.40.158 WebServer01_SSL26_OUTSIDE
name 109.228.40.159 WebServer01_SSL27_OUTSIDE
name 109.228.40.160 WebServer01_SSL28_OUTSIDE
name 109.228.40.161 WebServer01_SSL29_OUTSIDE
name 109.228.40.162 WebServer01_SSL30_OUTSIDE
name 109.228.40.163 WebServer01_SSL31_OUTSIDE
name 109.228.40.164 WebServer01_SSL32_OUTSIDE
name 109.228.40.165 WebServer01_SSL33_OUTSIDE
name 109.228.40.166 WebServer01_SSL34_OUTSIDE
name 109.228.40.167 WebServer01_SSL35_OUTSIDE
name 10.96.4.160 WebServer01_SSL14_INSIDE
name 10.96.4.161 WebServer01_SSL15_INSIDE
name 10.96.4.162 WebServer01_SSL16_INSIDE
name 10.96.4.163 WebServer01_SSL17_INSIDE
name 10.96.4.164 WebServer01_SSL18_INSIDE
name 10.96.4.165 WebServer01_SSL19_INSIDE
name 10.96.4.166 WebServer01_SSL20_INSIDE
name 10.96.4.167 WebServer01_SSL21_INSIDE
name 10.96.4.168 WebServer01_SSL22_INSIDE
name 10.96.4.169 WebServer01_SSL23_INSIDE
name 10.96.4.170 WebServer01_SSL24_INSIDE
name 10.96.4.171 WebServer01_SSL25_INSIDE
name 10.96.4.172 WebServer01_SSL26_INSIDE
name 10.96.4.173 WebServer01_SSL27_INSIDE
name 10.96.4.174 WebServer01_SSL28_INSIDE
name 10.96.4.175 WebServer01_SSL29_INSIDE
name 10.96.4.176 WebServer01_SSL30_INSIDE
name 10.96.4.177 WebServer01_SSL31_INSIDE
name 10.96.4.178 WebServer01_SSL32_INSIDE
name 10.96.4.179 WebServer01_SSL33_INSIDE
name 10.96.4.180 WebServer01_SSL34_INSIDE
name 10.96.4.181 WebServer01_SSL35_INSIDE
name 109.228.40.130 WebServer01_OUTSIDE_130
name 109.228.40.190 WebServer01_OUTSIDE_190
name 10.96.4.17 WebServer02_INSIDE_17
name 109.228.40.131 WebServer02_OUTSIDE_131
name 109.228.40.191 WebServer02_OUTSIDE_191
name 10.96.4.16 WebServer01_INSIDE_16
name 10.96.4.204 WebServer01_INSIDE_204
name 10.96.4.205 WebServer02_INSIDE_205 S
name 212.84.187.172 TEMP_PORTABLESPACE
name 194.105.69.38 NMS5
name 109.228.32.41 NMS0

interface GigabitEthernet0/1.405
nameif INSIDE
security-level 100
ip address 10.96.4.1 255.255.254.0 standby 10.96.4.2
!
interface GigabitEthernet0/0.3010
nameif OUTSIDE
security-level 0
ip address 109.228.40.128 255.255.255.0 standby 109.228.40.129
!
object-group service PLESK_PORTS tcp
port-object eq ftp-data
port-object eq ftp
port-object eq smtp
port-object eq domain
port-object eq www
port-object eq pop3
port-object eq imap4
port-object eq https
port-object eq 465
port-object eq 587
port-object eq 990
port-object eq 993
port-object eq 995
port-object eq 5432
port-object eq 8443
port-object eq 8447
port-object eq 8880
port-object eq 9080
port-object eq 11443
port-object eq 11444
port-object eq 5666
object-group network PLESK_SERVERS
network-object host WebServer01_OUTSIDE_130
network-object host WebServer02_OUTSIDE_131
network-object host DBServer01_OUTSIDE
network-object host WebServer01_OUTSIDE_190
network-object host WebServer02_OUTSIDE_191
object-group network AOffice
network-object host AOffice02
network-object host AOffice01
object-group service MANAGEMENT_PORTS tcp
port-object eq 3306
port-object eq ssh
object-group service WebPorts tcp
port-object eq www
port-object eq https
port-object eq ftp
port-object eq imap4
port-object eq pop3
port-object eq smtp
port-object eq 465
port-object eq 585
port-object eq 993
port-object eq 995
object-group network WebServers
network-object host WebServer01_SSL01_OUTSIDE
network-object host WebServer01_SSL02_OUTSIDE
network-object host WebServer01_SSL03_OUTSIDE
network-object host WebServer01_SSL04_OUTSIDE
network-object host WebServer01_SSL05_OUTSIDE
network-object host WebServer01_SSL06_OUTSIDE
network-object host WebServer01_SSL07_OUTSIDE
network-object host WebServer01_SSL08_OUTSIDE
network-object host WebServer01_SSL09_OUTSIDE
network-object host WebServer01_SSL10_OUTSIDE
network-object host WebServer01_SSL11_OUTSIDE
network-object host WebServer01_SSL12_OUTSIDE
network-object host WebServer01_SSL13_OUTSIDE
network-object host WebServer01_SSL14_OUTSIDE
network-object host WebServer01_SSL15_OUTSIDE
network-object host WebServer01_SSL16_OUTSIDE
network-object host WebServer01_SSL17_OUTSIDE
network-object host WebServer01_SSL18_OUTSIDE
network-object host WebServer01_SSL19_OUTSIDE
network-object host WebServer01_SSL20_OUTSIDE
network-object host WebServer01_SSL21_OUTSIDE
network-object host WebServer01_SSL22_OUTSIDE
network-object host WebServer01_SSL23_OUTSIDE
network-object host WebServer01_SSL24_OUTSIDE
network-object host WebServer01_SSL25_OUTSIDE
network-object host WebServer01_SSL26_OUTSIDE
network-object host WebServer01_SSL27_OUTSIDE
network-object host WebServer01_SSL28_OUTSIDE
network-object host WebServer01_SSL29_OUTSIDE
network-object host WebServer01_SSL30_OUTSIDE
network-object host WebServer01_SSL31_OUTSIDE
network-object host WebServer01_SSL32_OUTSIDE
network-object host WebServer01_SSL33_OUTSIDE
network-object host WebServer01_SSL34_OUTSIDE
network-object host WebServer01_SSL35_OUTSIDE
object-group network soVision
network-object Office 255.255.255.248
network-object host OfficeExternal
object-group service so_360DR tcp
port-object eq 6060
port-object eq 6061
object-group network TEMP_OLDSERVERS
network-object host TEMP_MRCOOL
network-object host TEMP_MRWIBBLE
network-object host TEMP_PORTABLESPACE
object-group service DNS tcp-udp
description DNS Access Ports
port-object eq domain
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group network NagiosMonitoring
network-object host WebServer01_OUTSIDE_130
network-object host WebServer02_OUTSIDE_131
network-object host DBServer01_OUTSIDE
access-list OUTSIDE_ACCESS_IN extended deny ip any any inactive
access-list OUTSIDE_ACCESS_IN extended permit tcp any object-group PLESK_SERVERS object-group PLESK_PORTS
access-list OUTSIDE_ACCESS_IN extended permit object-group TCPUDP any object-group WebServers object-group DNS
access-list OUTSIDE_ACCESS_IN remark SSH Access to servers from soVision
access-list OUTSIDE_ACCESS_IN extended permit tcp object-group soVision object-group PLESK_SERVERS object-group MANAGEMENT_PORTS
access-list OUTSIDE_ACCESS_IN extended permit tcp object-group AOffice object-group PLESK_SERVERS object-group MANAGEMENT_PORTS
access-list OUTSIDE_ACCESS_IN extended permit tcp any object-group WebServers object-group WebPorts
access-list OUTSIDE_ACCESS_IN extended permit tcp Office 255.255.255.248 object-group PLESK_SERVERS object-group so_360DR
access-list OUTSIDE_ACCESS_IN extended permit ip object-group TEMP_OLDSERVERS any
access-list OUTSIDE_ACCESS_IN extended permit object-group TCPUDP any object-group PLESK_SERVERS object-group DNS
access-list OUTSIDE_ACCESS_IN extended permit tcp host Office object-group NagiosMonitoring eq 5666
access-list OUTSIDE_ACCESS_IN extended permit tcp host NMS0 object-group NagiosMonitoring eq 5666
access-list OUTSIDE_ACCESS_IN extended permit icmp host Office object-group NagiosMonitoring echo-reply
access-list OUTSIDE_ACCESS_IN extended permit icmp host Office object-group NagiosMonitoring unreachable
access-list OUTSIDE_ACCESS_IN extended permit icmp host Office object-group NagiosMonitoring time-exceeded
access-list OUTSIDE_ACCESS_IN extended permit icmp host NMS0 object-group NagiosMonitoring echo-reply
access-list OUTSIDE_ACCESS_IN extended permit icmp host NMS0 object-group NagiosMonitoring echo
access-list OUTSIDE_ACCESS_IN extended permit icmp host NMS0 object-group NagiosMonitoring time-exceeded
access-list OUTSIDE_ACCESS_IN extended permit icmp host NMS0 object-group NagiosMonitoring unreachable
access-list OUTSIDE_ACCESS_IN extended permit udp host NMS0 object-group NagiosMonitoring eq 5666
access-list OUTSIDE_ACCESS_IN extended permit icmp host Office object-group NagiosMonitoring echo
access-list INSIDE_access_in extended permit ip 10.96.4.0 255.255.254.0 any
access-list OUTSIDE_access_in extended permit icmp host NMS5 any
access-list OUTSIDE_access_in extended permit icmp host NMS0 any
pager lines 24
logging enable
logging timestamp
logging monitor informational
logging buffered informational
logging trap notifications
logging asdm informational
mtu OUTSIDE 1500
mtu INSIDE 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (OUTSIDE) 1 interface
nat (INSIDE) 1 10.96.4.0 255.255.254.0
static (INSIDE,OUTSIDE) WebServer01_SSL03_OUTSIDE WebServer01_SSL03_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL04_OUTSIDE WebServer01_SSL04_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL05_OUTSIDE WebServer01_SSL05_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL06_OUTSIDE WebServer01_SSL06_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL07_OUTSIDE WebServer01_SSL07_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL09_OUTSIDE WebServer01_SSL09_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL10_OUTSIDE WebServer01_SSL10_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL11_OUTSIDE WebServer01_SSL11_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL12_OUTSIDE WebServer01_SSL12_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL13_OUTSIDE WebServer01_SSL13_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL08_OUTSIDE WebServer01_SSL08_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_OUTSIDE_130 WebServer01_INSIDE_16 netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer02_OUTSIDE_131 WebServer02_INSIDE_17 netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL01_OUTSIDE WebServer01_SSL01_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL02_OUTSIDE WebServer01_SSL02_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) DBServer01_OUTSIDE DBServer01_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL14_OUTSIDE WebServer01_SSL14_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL15_OUTSIDE WebServer01_SSL15_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL16_OUTSIDE WebServer01_SSL16_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL17_OUTSIDE WebServer01_SSL17_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL18_OUTSIDE WebServer01_SSL18_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL19_OUTSIDE WebServer01_SSL19_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL20_OUTSIDE WebServer01_SSL20_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL21_OUTSIDE WebServer01_SSL21_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL22_OUTSIDE WebServer01_SSL22_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL23_OUTSIDE WebServer01_SSL23_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL24_OUTSIDE WebServer01_SSL24_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL25_OUTSIDE WebServer01_SSL25_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL26_OUTSIDE WebServer01_SSL26_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL27_OUTSIDE WebServer01_SSL27_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL28_OUTSIDE WebServer01_SSL28_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL29_OUTSIDE WebServer01_SSL29_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL30_OUTSIDE WebServer01_SSL30_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL31_OUTSIDE WebServer01_SSL31_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL32_OUTSIDE WebServer01_SSL32_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL33_OUTSIDE WebServer01_SSL33_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL34_OUTSIDE WebServer01_SSL34_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_SSL35_OUTSIDE WebServer01_SSL35_INSIDE netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer02_OUTSIDE_191 WebServer02_INSIDE_205 netmask 255.255.255.255
static (INSIDE,OUTSIDE) WebServer01_OUTSIDE_190 WebServer01_INSIDE_204 netmask 255.255.255.255
access-group OUTSIDE_ACCESS_IN in interface OUTSIDE
access-group INSIDE_access_in in interface INSIDE
route OUTSIDE 0.0.0.0 0.0.0.0 109.228.40.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
aaa-server TACACS protocol tacacs+
aaa-server TACACS (OUTSIDE) host 213.171.217.136
key *****
aaa-server TACACS (OUTSIDE) host 213.171.201.38
key *****
aaa authentication ssh console TACACS LOCAL
aaa authentication http console TACACS LOCAL
aaa authentication enable console TACACS LOCAL
aaa authorization command TACACS LOCAL
aaa authorization exec authentication-server

nosnmp-server location
no snmp-server conta

no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect icmp
!
service-policy global_policy global
: end

Kind regards

Jake

Labels:
0 Helpful
9 Replies 9

Julio Carvajal
VIP Alumni
VIP Alumni

‎11-13-2012 12:40 PM

Hello Jake,

Do the following:

packet-tracer input inside icmp 10.96.4.10 8 0 4.2.2.2

Provide us the full output,

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
0 Helpful

Colourful
Level 1
Level 1
In response to Julio Carvajal

‎11-13-2012 12:56 PM

hase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         OUTSIDE

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group INSIDE_access_in in interface INSIDE
access-list INSIDE_access_in extended permit ip 10.96.4.0 255.255.254.0 any
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
  inspect icmp
service-policy global_policy global
Additional Information:

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (INSIDE) 1 10.96.4.0 255.255.254.0
  match ip INSIDE 10.96.4.0 255.255.254.0 OUTSIDE any
    dynamic translation to pool 1 (109.228.40.128 [Interface PAT])
    translate_hits = 113010, untranslate_hits = 15
Additional Information:
Dynamic translate 10.96.4.10/0 to 109.228.40.128/18454 using netmask 255.255.255.255

Phase: 8
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (INSIDE) 1 10.96.4.0 255.255.254.0
  match ip INSIDE 10.96.4.0 255.255.254.0 INSIDE any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 476687075, packet dispatched to next module

Result:
input-interface: INSIDE
input-status: up
input-line-status: up
output-interface: OUTSIDE
output-status: up
output-line-status: up
Action: allow

Here are the results. Could you explain te output as well. Thank-you

0 Helpful

Julio Carvajal
VIP Alumni
VIP Alumni
In response to Colourful

‎11-13-2012 01:03 PM

Hello Jake,

The output will show all the steps the ASA will use in order to allow or deny the traffic,

We can see the ACL allows the traffic, there is a NAT in between so it is performing the right NAT.

What is the source IP address you are comming from?

Regards

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
0 Helpful

Colourful
Level 1
Level 1
In response to Julio Carvajal

‎11-13-2012 01:17 PM

Jcarvaja,

I am attempting to come from the following external address:

194.105.64.4

Whis is currently covered in the "OFFICE" name.

0 Helpful

Julio Carvajal
VIP Alumni
VIP Alumni
In response to Colourful

‎11-13-2012 01:36 PM

194.105.64.4???

Where is that??? I mean that is on the outside interface of the ASA so something is wrong in here.

You only have 2 interfaces, none of them make difference to the 194? Do you see the problem?

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
0 Helpful

Colourful
Level 1
Level 1
In response to Julio Carvajal

‎11-13-2012 02:13 PM

That is an external site out the Outside interface. So - I'm attempting to ping an internal address from the 194.105.64.4 address but get no response. And no - I can't see any issues.

0 Helpful

Julio Carvajal
VIP Alumni
VIP Alumni
In response to Colourful

‎11-13-2012 02:31 PM

Hello Jake,

I'm attempting to ping an internal address from the 194.105.64.4 .... witch address???

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
0 Helpful

Colourful
Level 1
Level 1
In response to Julio Carvajal

‎11-13-2012 02:42 PM

Carva,

I'm attempting to ping WEBSERVER01_Outside.

static (INSIDE,OUTSIDE) WebServer01_OUTSIDE_130 WebServer01_INSIDE_16 netmask 255.255.255.255

Which has the following

Internal -  10.96.4.16

External - 109.228.40.130

So there is a one to one nat between these addresses. I can ping the internal fine - from the firewall.

Kind regards,

Jake

0 Helpful

Julio Carvajal
VIP Alumni
VIP Alumni
In response to Colourful

‎11-13-2012 02:59 PM

Do,

access-list OUTSIDE_ACCESS_IN permit icmp any host 109.228.40.130

If you still cannot ping it do

packet-tracer input outside icmp 194.105.64.4 8 0 109.228.40.130


Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card