0

Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there.

I have made my inside network and my outside network.

Firewall model is Cisco 5520 ASA

ciscoasa# sh access-lis
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list 101; 4 elements; name hash: 0xe7d586b5
access-list 101 line 1 extended permit icmp any any echo-reply (hitcnt=0) 0x0309                                                                                        01cd
access-list 101 line 2 extended permit icmp any any source-quench (hitcnt=0) 0x8                                                                                        bddfde8
access-list 101 line 3 extended permit icmp any any unreachable (hitcnt=0) 0x89d                                                                                        18f69
access-list 101 line 4 extended permit icmp any any time-exceeded (hitcnt=0) 0x1                                                                                        2127ce7
access-list outside_access_in; 5 elements; name hash: 0x6892a938
access-list outside_access_in line 1 extended permit icmp object outside3560 obj                                                                                        ect inside3560 (hitcnt=0) 0x4f1148e6
  access-list outside_access_in line 1 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 (hitcnt=0) 0x4f1148e6
access-list outside_access_in line 2 extended permit icmp object outside3560 obj                                                                                        ect inside3560 object-group ping (hitcnt=0) 0xc892322e
  access-list outside_access_in line 2 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 echo (hitcnt=0) 0x8d896526
  access-list outside_access_in line 2 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 echo-reply (hitcnt=0) 0xd3bb9910
access-list outside_access_in line 3 extended permit icmp object outside23560 ob                                                                                        ject inside35602 object-group ping (hitcnt=0) 0xa79083e6
  access-list outside_access_in line 3 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.12 echo (hitcnt=0) 0xca21b676
  access-list outside_access_in line 3 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.12 echo-reply (hitcnt=0) 0x5ca247e8
access-list inside; 1 elements; name hash: 0x45467dcb
access-list inside line 1 extended permit icmp host 192.168.1.11 host 192.168.2.                                                                                        21 (hitcnt=0) 0x00b26fe3
access-list outside; 1 elements; name hash: 0x1a47dec4
access-list outside line 1 extended permit icmp host 192.168.2.21 host 192.168.1                                                                                        .11 (hitcnt=0) 0x4310bc47

3560 Inside switch: 

L3Switch1#sh run
Building configuration...

Current configuration : 1542 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname L3Switch1
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface GigabitEthernet0/13
!
interface GigabitEthernet0/14
!
interface GigabitEthernet0/15
!
interface GigabitEthernet0/16
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
!
interface GigabitEthernet0/21
!
interface GigabitEthernet0/22
!
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface GigabitEthernet0/25
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/26
!
interface GigabitEthernet0/27
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/28
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 192.168.1.11 255.255.255.0
!
ip classless
ip http server
!
!
!
control-plane
!
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
end

3560 outside switch:

TransitSw# sh run
Building configuration...

Current configuration : 1839 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname TransitSw
!
!
no aaa new-model
system mtu routing 1500
vtp mode transparent
ip subnet-zero
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 10
 name inside-vlan
!
vlan 20,30,40,112-113
!
vlan 210
 name netmon
!
vlan 439
 name radio
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface GigabitEthernet0/13
!
interface GigabitEthernet0/14
!
interface GigabitEthernet0/15
!
interface GigabitEthernet0/16
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
!
interface GigabitEthernet0/21
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/22
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/23
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/24
!
interface Vlan1
 no ip address
 no ip route-cache
!
interface Vlan10
 ip address 192.168.1.12 255.255.255.0
 no ip route-cache
!
interface Vlan20
 ip address 192.168.20.14 255.255.255.0
 no ip route-cache
!
interface Vlan30
 ip address 192.168.30.14 255.255.255.0
 no ip route-cache
!
interface Vlan40
 ip address 192.168.40.14 255.255.255.0
 no ip route-cache
!
ip http server
!
control-plane
!
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
end

2960 Transmittor switch thats also inside:

Switch#sh run
Building configuration...

Current configuration : 3170 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password cisco
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
!
!
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface FastEthernet0/1
 switchport access vlan 10
!
interface FastEthernet0/2
 switchport access vlan 10
!
interface FastEthernet0/3
 switchport access vlan 10
!
interface FastEthernet0/4
 switchport access vlan 10
!
interface FastEthernet0/5
 switchport access vlan 10
!
interface FastEthernet0/6
 switchport access vlan 20
!
interface FastEthernet0/7
 switchport access vlan 20
!
interface FastEthernet0/8
 switchport access vlan 20
!
interface FastEthernet0/9
 switchport access vlan 20
!
interface FastEthernet0/10
 switchport access vlan 20
!
interface FastEthernet0/11
 switchport access vlan 30
!
interface FastEthernet0/12
 switchport access vlan 30
!
interface FastEthernet0/13
 switchport access vlan 30
!
interface FastEthernet0/14
 switchport access vlan 30
!
interface FastEthernet0/15
 switchport access vlan 30
!
interface FastEthernet0/16
 switchport access vlan 40
!
interface FastEthernet0/17
 switchport access vlan 40
!
interface FastEthernet0/18
 switchport access vlan 40
!
interface FastEthernet0/19
 switchport access vlan 40
!
interface FastEthernet0/20
 switchport access vlan 40
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface FastEthernet0/25
!
interface FastEthernet0/26
!
interface FastEthernet0/27
!
interface FastEthernet0/28
!
interface FastEthernet0/29
!
interface FastEthernet0/30
!
interface FastEthernet0/31
!
interface FastEthernet0/32
!
interface FastEthernet0/33
!
interface FastEthernet0/34
!
interface FastEthernet0/35
!
interface FastEthernet0/36
!
interface FastEthernet0/37
!
interface FastEthernet0/38
!
interface FastEthernet0/39
!
interface FastEthernet0/40
!
interface FastEthernet0/41
!
interface FastEthernet0/42
!
interface FastEthernet0/43
!
interface FastEthernet0/44
!
interface FastEthernet0/45
!
interface FastEthernet0/46
!
interface FastEthernet0/47
!
interface FastEthernet0/48
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface Vlan1
 ip address 10.0.0.1 255.255.255.0
!
interface Vlan10
 ip address 192.168.2.21 255.255.255.0
 standby 1 ip 192.168.10.15
 standby 1 preempt
!
interface Vlan20
 ip address 192.168.20.10 255.255.255.0
 standby 1 ip 192.168.20.15
 standby 1 preempt
!
interface Vlan30
 ip address 192.168.30.10 255.255.255.0
 standby 1 ip 192.168.30.15
 standby 1 preempt
!
interface Vlan40
 ip address 192.168.40.10 255.255.255.0
 standby 1 ip 192.168.40.15
 standby 1 preempt
!
interface Vlan99
 ip address 192.168.99.99 255.255.255.0
!
ip default-gateway 10.0.0.254
ip classless
ip http server
ip http secure-server
!
!
!
control-plane
!
!
line con 0
line vty 0 4
 password cisco
 login
line vty 5 15
 login
!
end

TransitSw#
Improve this question
3
  • 2
    You will need to provide more information. What is the firewall model and (sanitized) configuration. You should edit your question to provide this information. I also assume when you say port, you mean an interface on the firewall since ports have nothing to do with ICMP (ping).
    – Ron Maupin ♦
    Jul 25, 2016 at 21:37
  • The firewall model is Cisco 5520 ASA, and yeah, allowing a physical interface on the firewall to go from inside to outside
    – Moiz Khan
    Jul 26, 2016 at 14:00
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Nov 20, 2022 at 0:21

2 Answers 2

Reset to default
0

You need NAT to re-write from your outside IP address(es) to your inside addresses. Then you will also need two rules to allow outside access to your internal target IP address on ICMP and port 23 (Telnet)

How exactly you will do this depends on your gateway device.

Improve this answer
3
  • can you please give me a configuration example so i can allow outside ip to go to inside? i am just trying to get through a firewall, i have a 3560 switch on outside and a 3560 on inside, just trying to get the ips to ping each other or telnet each other
    – Moiz Khan
    Jul 26, 2016 at 16:49
  • 3560 Switch(outside) ---5520 ASA Firewall --- 2960 Switch(inside)---- 3560(Inside)
    – Moiz Khan
    Jul 26, 2016 at 16:51
  • I just have a firewall connecting between a switch in the inside and a switch from the outside. im just trying to get addresses from inside to ping addresses to outside
    – Moiz Khan
    Jul 26, 2016 at 17:49
0

create objects first:

object network outside3560
 host 10.0.0.1

object network inside3560 
 host 10.0.1.1

object-group icmp-type ping
 icmp-object echo
 icmp-object echo-reply

then the acl:

access-list outside_access_in extended permit icmp object outside3560 object inside3560 object-group ping

then apply it to the interface:

access-group outside_access_in global
Improve this answer
16
  • are all those commands done on firewall? , after i do those commands, can i ping inside from an outside 3560?
    – Moiz Khan
    Jul 26, 2016 at 20:48
  • also, i would like to telnet from inside to outside
    – Moiz Khan
    Jul 26, 2016 at 20:53
  • Traffic from higher sec levels to lower sec levels is permitted by default. If you've named your inside interface 'inside' then I think the ASA automatically assigns it a security level of 100. It should just work.
    – Mark
    Jul 26, 2016 at 22:12
  • @Stan234 add second ACL access-list outside_access_in extended permit tcp object outside3560 object inside3560 eq telnet
    – tyler durden
    Jul 27, 2016 at 5:20
  • @Mark ASA doesn't do ICMP inspection by default, either ACL must be used, regardless of security levels or ICMP must be enabled at default inspection rule.
    – tyler durden
    Jul 27, 2016 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.