Routing between ASA 5510 interfaces

[haytham elsamadony]

Hi Guys

I have Cisco ASA 5510 at one of our sites

i have an issue with this asa, the servers at inside zone with 100 level security can`t reach to the outside zone level zero

when i try to ping from the server, it can reach to the inside interface ( his GW ), but i can`t ping the outside interface at same ASA

what i understand that by default this ping should be work because it came from zone with high security level to zone with low security level

Or, there are some routing configuration required between ASA interfaces i should do it 

Thanks

[Rob Ingram · Accepted solution]

Hi,

Are you attempting to ping the ASAs outside interface from a device connected to the inside of the ASA? If so that won’t work (by design).

If you are pinging through the ASA to another device you need to ensure you inspect icmp, use the command “fixup protocol icmp”.

HTH 

[haytham elsamadony]

yes, i want to ping from device connected to inside interface to outside interface

OK i can`t by design, but if i want to check the connectivity between this device and other behind this firewall

how i can know that the traffic from inside device walk through the firewall to the destination ??

[Rob Ingram]

You may not be able to ping the ASAs outside interface when connected to the inside, but you can certainly ping through the ASA - so ping the other device behind the firewall, that will work. For that to work you will need the icmp inspect configured using the command I previously provided "fixup protocol icmp".

HTH

[haytham elsamadony]

Ok so what i understand that, to ping the other device behind the firewall i must apply this icmp inspect 

and without this command i will not be able to ping through the firewall 

 is this right ?

[Rob Ingram]

Correct.

Alternatively you could explictly permit icmp inbound on the outside interface, however most people enable icmp inspection using the command I provided.

[haytham elsamadony]

Ok thanks Rob your replies were very helpful for me

thanks again