Unable to ping inside interface on asa 5505

[DON F]

Access to inside interface not working, it worked previously. Compared original configurations and not seeing any changes.

what am I missing?

Vlan 75 - Outside interface to an ISP DSL router

Vlan 55 - Inside interface to 3750 with IP of 55.2. Unable to ping this ip and all other devices hanging off the 3750.

Configuration attached..

[carlguer]

Hi DON F,

It's not very clear what you are trying to do.

Are you trying to ping the internal resources while being outside of the "inside" network?

Are you able to ping the outside interface of the ASA?

[DON F]

I'm trying to access the network behind the Inside interface and the directly connected interface (10.14.55.2). I can ping the outside interfaces or google, etc...when in the ASA, but nothing in the Inside is reachable via pings.

[Marvin Rhoads]

Can you share the output of the following from the 3750 switch:

show run int vlan 55

show run int <interface the ASA is connected to>

show ip int br | i 10.14.55

show int <interface the ASA is connected to>

[DON F]

The equipment is in another country. The ASA was my means to access the network and into the 3750.

[Marvin Rhoads]

That's unfortunate.

From the ASA configuration you shared (and especially since it was working previously and was not changed) it should work.

You might check your ARP cache to see if you're even getting it populated with the MAC address from the switch when you try and fail to connect.

You might also do a packet capture on that inside interface and see if anything jumps out at you. I'd look for something like VLAN mismatch or untagged (802.1q-wise) frames in the incoming traffic.

Beyond that, you need someone on site to give you remote hands assistance.

[DON F]

Update -- When I ssh into the ASA 5505, I can ping all devices in the inside network. Someone at the far end had move the connection to another port.

The issue now is when I VPN, the VPN client is not able to ping the inside interface of the ASA or the inside network. Also in the ASA I am unable to ping the VPN clients assigned ip pool.

Regards,

[Richard Burts]

In looking through the config I do not see a command like this

management-access inside

I suggest that you add this to the config. Also I do not see an inspect for icmp  as part of your inspect policies. I suggest that you add it. Both of these may be helpful in resolving issues with ping access.

HTH

Rick

[DON F]

Added suggested lines. But, no dice.

[Richard Burts]

If you can ping to inside devices from SSH session that is improvement. If VPN client can not ping inside my first question would be whether the inside has a route to the address pool for the VPN client.

HTH

Rick

[Marvin Rhoads]

Your configuration does not have any NAT or NAT exemption for your VPN client address pool. How does the overall system handle NATting?

We would normally expect a NAT setup including something like this:

object network inside_network

 subnet 10.14.0.0 255.255.0.0

object network VPN_network

 subnet 10.14.100.0 255.255.255.0

nat (inside,outside) source static inside_network inside_network destination static VPN_network VPN_network no-proxy-arp route-lookup

[DON F]

I had a similar line. I edited my lines to the suggested lines. The suggested lines adds a description at the same time.

Still no go. I uploaded a more recent config.

BTW - Thanks for the continuing support.

[DON F]

Marvin - thanks for the hint. Issue resolved... I reversed the the lines in the nat section -- inside_network to VPN_network.

Old:

nat (inside,outside) source static inside_network inside_network destination static VPN_network VPN_network no-proxy-arp route-lookup

New:

nat (inside,outside) source static VPN_network VPN_network destination static inside_network inside_network no-proxy-arp route-lookup

[Marvin Rhoads]

You're welcome - glad we were able to resolve it together.

Please rate any useful replies.