Hello -
I am trying to open up ping through my ASA. The ASA is connected via L3 link on the inside interface to a L3 switch. Same thing on the outside
interface. I am trying to ping switch to switch via the ASA.
I created the ACLs as follows
access-list outside-in permit extended icmp any any echo
access-list outside-in permit extended icmp any any echo-reply
access-list inside-out permit extended icmp any any echo
access-list inside-out permit extedned icmp any any echo-reply
I applied this ACL to the interfaces
access-group outside-in in interface outside
access-group inside-out in interface inside
I also enabled icmp inspection under the global service policy.
inspect icmp
inspect icmp error
In addition I opened up icmp to the ASA interfaces
icmp permit any outside
icmp permit any inside
Pinging to/from the ASA inside/outside interfaces works fine.
However, when I try to go switch to switch via the ASA it fails. Outbound, I see the echo-request come in on the inside interface and be forwarded to the outside interface in the icmp debug trace output. But no echo-request from the inside L3 switch interface.
Now when I ping from the inside L3 switch to the outside L3 switch I do not see any echo-request come in on inside interface. The "icmp debug trace" output has nothing. So what other things can I look at that would prevent echo-request from coming into the ASA when the destination is on the inside? I can ping the ASA's inside interface from the inside L3 switch. I see those echo-request/replies no problem.
Thanks
Chuck
