why can not ping from router A to router B , inside to outside

martlee2 · ‎01-12-2015

after add route and policy inspect still can not ping from inside router to outside router in GNS3

conf t
access-list acl_outside_new extended permit icmp any any
access-list acl_outside_new extended permit tcp any any eq www
end
conf t
access-group acl_outside_new in interface inside
end

conf t
class-map icmp-class
match default-inspection-traffic
exit
policy-map icmp_policy
class icmp-class
inspect icmp
exit
service-policy icmp_policy interface outside
end

conf t
route outside 0.0.0.0 0.0.0.0 192.168.3.3
end

inside outside
192.168.1.2 router ---switch--- 192.168.1.1 ASA 192.168.3.4 ---switch---- 192.168.3.3 router

ASA Version 8.4(2)

!

hostname ASA-1

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface GigabitEthernet0

description INSIDE

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface GigabitEthernet1

description OUTSIDE

nameif outside

security-level 0

ip address 192.168.3.4 255.255.255.0

!

interface GigabitEthernet2

shutdown

no nameif

no security-level

<--- More --->

no ip address

<--- More --->

!

<--- More --->

interface GigabitEthernet3

<--- More --->

shutdown

<--- More --->

no nameif

<--- More --->

no security-level

<--- More --->

no ip address

<--- More --->

!

<--- More --->

ftp mode passive

<--- More --->

object network DYNAMIC-PAT

<--- More --->

subnet 192.168.1.0 255.255.255.0

<--- More --->

access-list acl_outside_new extended permit icmp any any

<--- More --->

access-list acl_outside_new extended permit tcp any any eq www

<--- More --->

pager lines 24

<--- More --->

mtu inside 1500

<--- More --->

mtu outside 1500

<--- More --->

icmp unreachable rate-limit 1 burst-size 1

<--- More --->

no asdm history enable

<--- More --->

arp timeout 14400

<--- More --->

!

<--- More --->

object network DYNAMIC-PAT

<--- More --->

nat (inside,outside) dynamic interface

<--- More --->

access-group acl_outside_new in interface inside

<--- More --->

route outside 0.0.0.0 0.0.0.0 192.168.3.3 1

<--- More --->

timeout xlate 3:00:00

<--- More --->

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

<--- More --->

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

<--- More --->

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

<--- More --->

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

<--- More --->

timeout tcp-proxy-reassembly 0:01:00

<--- More --->

timeout floating-conn 0:00:00

<--- More --->

dynamic-access-policy-record DfltAccessPolicy

<--- More --->

user-identity default-domain LOCAL

<--- More --->

no snmp-server location

<--- More --->

no snmp-server contact

<--- More --->

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

<--- More --->

telnet timeout 5

<--- More --->

ssh timeout 5

<--- More --->

console timeout 0

<--- More --->

threat-detection basic-threat

<--- More --->

threat-detection statistics access-list

<--- More --->

no threat-detection statistics tcp-intercept

<--- More --->

!

<--- More --->

class-map icmp-class

<--- More --->

match default-inspection-traffic

<--- More --->

!

<--- More --->

!

<--- More --->

policy-map icmp_policy

<--- More --->

class icmp-class

<--- More --->

inspect icmp

<--- More --->

!

<--- More --->

service-policy icmp_policy interface outside

<--- More --->

prompt hostname context

<--- More --->

no call-home reporting anonymous

<--- More --->

call-home

<--- More --->

profile CiscoTAC-1

<--- More --->

no active

<--- More --->

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

<--- More --->

destination address email callhome@cisco.com

<--- More --->

destination transport-method http

<--- More --->

subscribe-to-alert-group diagnostic

<--- More --->

subscribe-to-alert-group environment

<--- More --->

subscribe-to-alert-group inventory periodic monthly

<--- More --->

subscribe-to-alert-group configuration periodic monthly

<--- More --->

subscribe-to-alert-group telemetry periodic daily

<--- More --->

crashinfo save disable

<--- More --->

Cryptochecksum:3d4b67331439dec2118f84d0c0b36d88

<--- More --->

: end

ASA-1#

ASA-1# sh run | no ?

begin Begin with the line that matches

exclude Exclude lines that match

grep Include/exclude lines that match

include Include lines that match

ASA-1# sh run | packet-tracer input inside icmp 192.168.1.2 8 0 192.168.3.3 detailed

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 192.168.3.0 255.255.255.0 outside

Phase: 2

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group acl_outside_new in interface inside

access-list acl_outside_new extended permit icmp any any

Additional Information:

Forward Flow based lookup yields rule:

in id=0xbc2fd2b8, priority=13, domain=permit, deny=false

hits=0, user_data=0xb9466a40, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 3

<--- More --->

Type: IP-OPTIONS

<--- More --->

Subtype:

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

Additional Information:

<--- More --->

Forward Flow based lookup yields rule:

<--- More --->

in id=0xbc0f97d8, priority=0, domain=inspect-ip-options, deny=true

<--- More --->

hits=3, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

<--- More --->

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

<--- More --->

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

<--- More --->

input_ifc=inside, output_ifc=any

<--- More --->

Phase: 4

<--- More --->

Type: INSPECT

<--- More --->

Subtype: np-inspect

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

Additional Information:

<--- More --->

Forward Flow based lookup yields rule:

<--- More --->

in id=0xbc0f93b0, priority=66, domain=inspect-icmp-error, deny=false

<--- More --->

hits=3, user_data=0xbc0f89c8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

<--- More --->

src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

<--- More --->

dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

<--- More --->

input_ifc=inside, output_ifc=any

<--- More --->

Phase: 5

<--- More --->

Type: NAT

<--- More --->

Subtype:

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

object network DYNAMIC-PAT

<--- More --->

nat (inside,outside) dynamic interface

<--- More --->

Additional Information:

<--- More --->

Dynamic translate 192.168.1.2/0 to 192.168.3.4/24940

<--- More --->

Forward Flow based lookup yields rule:

<--- More --->

in id=0xbc2fb6a8, priority=6, domain=nat, deny=false

<--- More --->

hits=3, user_data=0xbc0fd610, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

<--- More --->

src ip/id=192.168.1.0, mask=255.255.255.0, port=0

<--- More --->

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

<--- More --->

input_ifc=inside, output_ifc=outside

<--- More --->

Phase: 6

<--- More --->

Type: INSPECT

<--- More --->

Subtype: np-inspect

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

class-map icmp-class

<--- More --->

match default-inspection-traffic

<--- More --->

policy-map icmp_policy

<--- More --->

class icmp-class

<--- More --->

inspect icmp

<--- More --->

service-policy icmp_policy interface outside

<--- More --->

Additional Information:

<--- More --->

Forward Flow based lookup yields rule:

<--- More --->

out id=0xbc300220, priority=72, domain=inspect-icmp, deny=false

<--- More --->

hits=3, user_data=0xbc302bf0, cs_id=0x0, flags=0x0, protocol=1

<--- More --->

src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

<--- More --->

dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

<--- More --->

input_ifc=any, output_ifc=outside

<--- More --->

Phase: 7

<--- More --->

Type: IP-OPTIONS

<--- More --->

Subtype:

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

Additional Information:

<--- More --->

Reverse Flow based lookup yields rule:

<--- More --->

in id=0xbc2edc58, priority=0, domain=inspect-ip-options, deny=true

<--- More --->

hits=4, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

<--- More --->

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

<--- More --->

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

<--- More --->

input_ifc=outside, output_ifc=any

<--- More --->

Phase: 8

<--- More --->

Type: FLOW-CREATION

<--- More --->

Subtype:

<--- More --->

Result: ALLOW

<--- More --->

Config:

<--- More --->

Additional Information:

<--- More --->

New flow created with id 5, packet dispatched to next module

<--- More --->

Module information for forward flow ...

<--- More --->

snp_fp_tracer_drop

<--- More --->

snp_fp_inspect_ip_options

<--- More --->

snp_fp_inspect_icmp

<--- More --->

snp_fp_translate

<--- More --->

snp_fp_adjacency

<--- More --->

snp_fp_fragment

<--- More --->

snp_ifc_stat

<--- More --->

Module information for reverse flow ...

<--- More --->

snp_fp_tracer_drop

<--- More --->

snp_fp_inspect_ip_options

<--- More --->

snp_fp_translate

<--- More --->

snp_fp_inspect_icmp

<--- More --->

snp_fp_adjacency

<--- More --->

snp_fp_fragment

<--- More --->

snp_ifc_stat

<--- More --->

Result:

<--- More --->

input-interface: inside

<--- More --->

input-status: up

<--- More --->

input-line-status: up

<--- More --->

output-interface: outside

<--- More --->

output-status: up

<--- More --->

output-line-status: up

<--- More --->

Action: allow

<--- More --->

ASA-1#

Julio Carvajal · ‎01-12-2015

Hello,

Do the following

config te

clear configure fixup

fixup protocol icmp

Then Give it a try!

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2-CCNP, JNCIS-SEC
For inmediate assistance hire us at http://i-networks.us

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

martlee2 · ‎01-13-2015

actually i run in GNS3,

after running above commands in ASA,

router A still can not ping router B

do router A and router B need extra setting ?

i only run

Router A

conf t
int fastEthernet 0/0
ip address 192.168.1.2 255.255.255.0
no shut
end

Router B

conf t
int fastEthernet 0/0
ip address 192.168.3.3 255.255.255.0
no shut
end

Julio Carvajal · ‎01-13-2015

They need to have an static route mate!

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC