cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
748
Views
0
Helpful
14
Replies

unable to ping from OUTSIDE to INSIDE in cisco ASA....NEED urgent help

kousikdutta
Level 1
Level 1

Hi,

 

I am not able to ping from outside to inside. For below diagram

 

R1(Inside)-------------ASA-----------------R2(outside)

            192.168.12.0/24         10.10.12.0/24

 

ASA Config

 

ciscoasa# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
nameif inside
security-level 100
ip address 192.168.12.2 255.255.255.0
!
interface GigabitEthernet1
nameif outside
security-level 0
ip address 10.10.12.1 255.255.255.0
!
interface GigabitEthernet2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet5
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
object network NAT_OUT_IN
subnet 0.0.0.0 0.0.0.0
access-list ALLOW_ICMP extended permit icmp any any echo-reply
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
access-group ALLOW_ICMP in interface inside
access-group ALLOW_ICMP out interface inside
access-group ALLOW_ICMP in interface outside
route inside 0.0.0.0 0.0.0.0 192.168.12.1 1
route outside 2.2.2.2 255.255.255.255 10.10.12.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e

 

Note: Inside to outside is pinging.

 

Regards,

K

14 Replies 14

Hello,

 

add:

 

access-list ALLOW_ICMP extended permit icmp any any echo

 

to your access list...

Sorry its not pinging

Hello,

 

I recreated your setup in GNS3, the only difference is that I switched the default routes:

 

route outside 0.0.0.0 0.0.0.0 192.168.12.1 1
route inside 2.2.2.2 255.255.255.255 10.10.12.1 1

Hi,

 

Thanks for you very quick response. Please find below output.

 

ciscoasa(config-if)# packet-tracer input inside tcp 10.10.12.1 133 192.168.12.$

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xbc2a1708, priority=1, domain=permit, deny=false
hits=5, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=inside, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.12.2 255.255.255.255 identity

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xbc2a1d88, priority=0, domain=permit, deny=true
hits=0, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=inside, output_ifc=any

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

 

If you dont mind can you please share your asa config so that I can compare

 

 

yes. thanks for your support. its pinging now

sorry till ASA its pinging but not R1.. Please help

Hello,

 

post the configs of the routers, the problem might be there...

----R1---------

hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface GigabitEthernet1/0
ip address 192.168.12.1 255.255.255.0
negotiation auto
!
ip route 0.0.0.0 0.0.0.0 192.168.12.2
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!

!
webvpn cef
!

 

--------------R2-------------

 

Router#sh run
Building configuration...

Current configuration : 854 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface GigabitEthernet1/0
ip address 10.10.12.2 255.255.255.0
negotiation auto
!
ip route 1.1.1.1 255.255.255.255 10.10.12.1
ip route 192.168.12.0 255.255.255.0 10.10.12.1
no ip http server
no ip http secure-server
!
!
!
logging alarm informational
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
!

!
webvpn cef
!
end

ciscoasa(config)# packet-tracer input outside tcp 10.10.12.2 123 192.168.12.1 $

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xbc2c5240, priority=1, domain=permit, deny=false
hits=4366, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=outside, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.12.0 255.255.255.0 inside

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xbc2c5ee8, priority=11, domain=permit, deny=true
hits=0, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Hello,

 

make sure your access list looks like this:

 

access-list ALLOW_ICMP extended permit icmp any any echo-reply

access-list ALLOW_ICMP extended permit icmp any any echo

 

Also post the config of the other router...

Hi Pauwen,

 

Till yesterday it was not pinged. Just point came to my mind that is there any requirement to configure nat (outside,inside) as well.

 

Regards,

K

Hello,

 

you don't need NAT, as a matter of fact, delete the line below from your config:

 

--> no nat (inside,outside) source dynamic any interface

Hi,

 

Whenever I am configuring 

 

ciscoasa(config)# sh run nat
nat (inside,outside) source dynamic any interface
nat (outside,inside) source dynamic any interface
!

Then its pinging. When removing outside to inside nat its not pinging

Hello,

 

what are you trying to accomplish, what is the requirement ? Just for ICMP connectivity, you don't need NAT...

Review Cisco Networking for a $25 gift card