PING from outside into inside host

johnlee43 · ‎05-14-2013

Hi everyone,

I have ASA 5520.

I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Help me please.

Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.
From outside host, I used "PING 198.24.210.226". Is it because I used dynamic PAT for inside hosts?

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 198.24.210.230 255.255.255.248
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0

access-list OUTSIDE-IN extended permit ip any any
access-list OUTSIDE-IN extended permit icmp any any

access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 198.24.210.226 192.168.1.20 netmask 255.255.255.255
access-group OUTSIDE-IN in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 198.24.210.225 1

Thank you for your response.

Jouni Forss · ‎05-14-2013

Hi,

Make sure you have ICMP Inspection enabled.

Configure this if its not (or just to be sure)

fixup protocol icmp

fixup protocol icmp error

I wouldnt recommend permitting all "ip" traffic from the "outside"

The Dynamic PAT is no problem here. Static NAT for a host overrides Dynamic PAT. In other words the host will always use the Static NAT public IP address when connected to and when connecting out from the network.

- Jouni

johnlee43 · ‎05-14-2013

Thank you Jouni,

ICMP Inspection is enabled for ICMP & ICMP ERROR.

But still I cannot PING.

SYSLOG shows that

INBOUND ICMP CONNECTION has been built but right after that

TEARDOWN ICMP CONNECTION shows up.

What other part do I need to check?

harvisin · ‎05-21-2013

Hello,

I went through your query and can suggest you one thing that you can restart your ASA if it is not a live production environemnt and if still the problem presists then I yhink there is an issue with Dynamic gloabal PAT that you have done.