How to block Pinging the ASA 5506 outside interface ?

[gihansvn24]

I have configured a Cisco ASA and setup VPN configuration. Everything is working fine. The ASA outside interface is pingable (from internet) which is a security threat. How to only block pinging the outside interface without interrupting the functions of the ASA. I have tried the following but not seems to be working.

outside IP = 169.215.243.X

ASA Version 9.3(2)2

Access list BLOCK_PING deny icmp any host 169.251.243.X echo-reply

Access-group BLOCK_PING in interface outside

[Karsten Iwen · Accepted solution]

The ACL you configured is only for traffic that gets send through the ASA, traffic to the ASA is controlled in different ways. For ICMP you can deny pinging the ASA and allowing all other ICMP with the following config:

icmp deny any echo outside
icmp permit any outside

Disallowing all ICMP is also possible:

icmp deny any outside

The "truth" is probably somewhere between both options. It's your choice.