Cisco ASA Gateway ICMP?

[smorrissey88]

Hi all,

Say I have 2 networks created on an ASA (where ASA is the gateway for each one):

• NetA: 10.7.5.0/24
• NetB: 10.7.7.0/24

Computers on NetA (10.7.5.200) can ping computers on NetB (10.7.7.2, etc) just fine

Computers on NetA (10.7.5.200) can ping Gateway for NetA (10.7.5.1) just fine

Computers on NetA (10.7.5.200) CANNOT ping Gateway for NetB (10.7.7.1) however

What am I missing here? In my logs I see:

Built inbound ICMP connection for faddr 10.7.5.200/19606 gaddr 10.7.7.1/0 laddr 10.7.7.1/0
Teardown ICMP connection for faddr 10.7.5.200/19606 gaddr 10.7.7.1/0 ladd

I'm guessing there is a setting in ASDM somewhere to allow ICMP replies across networks, but I cannot seem to find it. 

Any assistance is GREATLY appreciated!

[Karsten Iwen · Accepted solution]

You are not missing anything here. That is normal behavior for the ASA. You can only ping the ASA-interface that is nearest to you, but not any other interface of the ASA.

[smorrissey88]

Interesting, is there a reason why by chance?

I'm mainly wondering because I'm trying to monitor my ASA over an site-to-site VPN tunnel, and the monitoring platform tries to ping the IP I give it, and I don't know what IP to give it because I have no idea which interface is "nearest" in the scenario of a remote network -- I'm assuming none of them.

[Karsten Iwen · Accepted solution]

I can't tell you a reason for this, but for VPNs, there is a special handling. A remote interface can be reached through a tunnel if that interface is defined as management-interface:

asa(config)# management-access inside

[smorrissey88]

Thank you, that's what I was missing. I have numerous "inside" interfaces, so I just set the management-access on the interface I was trying to hit with SNMP and everything started working over IPSEC.

[B.kablawi90]

have you configured ICMP Inspect to allow ping to reach the ASA ?