2

I have those 3 Interfaces configured:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address PUBLICIP 255.255.255.240 
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0 
!
interface GigabitEthernet0/3
 no nameif
 security-level 100
 ip address 172.200.0.1 255.255.255.0 
!
interface GigabitEthernet0/3.99
 vlan 99
 nameif servers
 security-level 100
 ip address 172.16.18.1 255.255.255.0                                                                                                 
!

also I have a default route

route outside 0.0.0.0 0.0.0.0 ISP_GATEWAY 1

and these NAT Rules

nat (inside,servers) source static any any
nat (inside,outside) source static any interface unidirectional description Internetaccess

also

enable traffic between two or more interfaces which are configured with same security levels

and

enable traffic between two or more hosts connected to the same interface

activated.

I am able to go on the internet with the "inside" network. But I can't ping the Gateway 172.16.18.1. Also, i have a client on Interface 3 connected with the ip 172.16.18.168/24 with the gateway 172.16.18.1. This client is alsp not able to ping 172.16.18.1.

In ASDM, I'm able to ping the Gateway from the servers interface. What am I missing? I read here that i have to configure for every VLAN I have, a NAT-Statement. Is this true? Because I need 10 VLANs.

I can't figure out what I'm missing. When I do Packet tracer in ASDM no ACL seems to block it.

PS: the two clients are directly connected to the ports. PS:PS: I am configuring 80% over ASDM and 20% over CLI (the way I learned in school).

Improve this question
7
  • 2
    By default ASA block ICMP, you have to explicitly allow it.
    – JFL
    May 25, 2016 at 12:34
  • It is allowed: 'policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect http !'
    – SystemCookie
    May 25, 2016 at 12:40
  • You really need to include the whole configuration. Also the configuration of the switch attached to the ASA.
    – Ron Maupin ♦
    May 25, 2016 at 14:26
  • I think this command nat (inside,servers) source static any any is incorrect. What are you trying to do with this NAT?
    – Ron Trunk
    May 25, 2016 at 16:42
  • 1
    Do you have a device which understands VLAN tags? Most end-devices don't understand VLAN tags. The switch will give non-tagged frames to the end devices in each VLAN. I'm not sure you can properly test this without a switch.
    – Ron Maupin ♦
    May 25, 2016 at 18:45

1 Answer 1

Reset to default
1

1.The FW is setup to work like that, you are only able to ping the interface that you are connected to, so if you are on the inside subnet you wont be able to ping the Servers interface nor the outside interface only the inside interface. In addition when it is traffic TO the box it does not check the ACLs, only for traffic that goes THROUGH the box is checked with the ACLs, now if you could attach the output from the "show run icmp" command I could confirm if you have any miss-configuration there that is preventing the ICMP requests for that interface.

2.If all vlans require internet access then yes, you would need to configure a NAT statement for each one of them, now if it is going to be accessed only from users on the inside there really is no need for the NAT since routing should be enough.

PD: It would be useful if you setup a capture in the interface to confirm that the ICMP message reach the interface, or plug-in the device directly to the interface to run the test.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.