1

Trying to go from inside network to outside network, I have a 3560 switch connecting to a 2960 switch which connects to 5520 ASA firewall. I have a Single 3560 switch for my outside network connecting to the firewall. When I ping the outside host I dont get response, can someone please help, thanks

Here is my config for the firewall:

5520ASA# sh run
: Saved
:
: Serial Number: JMX1131L1ZU
: Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
:
ASA Version 9.1(7)
!
hostname 5520ASA
domain-name NetworkBell
enable password 2KFQnbNIdI.2KYOU encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
 nameif inside
 security-level 100
 ip address 192.168.1.10 255.255.255.0
!
interface GigabitEthernet0/1
 nameif outside
 security-level 0
 ip address 192.168.2.20 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.3.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
 domain-name NetworkBell
object network outside3560
 host 192.168.2.21
object network inside3560
 host 192.168.1.11
object-group icmp-type ping
 icmp-object echo
 icmp-object echo-reply
access-list outside_access_in extended permit icmp object outside3560 object inside3560 object-group ping
access-list inside extended permit icmp host 192.168.1.11 host 192.168.2.21
access-list outside extended permit icmp host 192.168.2.21 host 192.168.1.11
pager lines 24
mtu management 1500
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group inside in interface inside
access-group outside_access_in global
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.160.41 255.255.255.255 management
http 192.168.3.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.3.0 255.255.255.0 management
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.3.2-192.168.3.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!
!
policy-map global_policy
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end
5520ASA#
2
  • Please post the configs for the 3560 and the 2960 so we can see if you have an ACL in the configurations on either of those in addition to the ACLs you have in the ASA. Aug 15, 2016 at 15:52
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 14:52

1 Answer 1

2

You have the access list "inside" on both the inside and outside interfaces

8
  • Hi Ron, I removed the line "access-group inside in interface outside" but it still seems to fail to ping from inside out or vice versa. Do you think their could be another reason?
    – Moiz Khan
    Aug 2, 2016 at 14:02
  • Check the firewall logs. It will tell you why it's blocking the pings.
    – Ron Trunk
    Aug 2, 2016 at 14:04
  • how do i check firewall logs ?
    – Moiz Khan
    Aug 2, 2016 at 14:19
  • "Monitoring" tab in the GUI
    – Ron Trunk
    Aug 2, 2016 at 14:21
  • im not using ASDM, just CLI
    – Moiz Khan
    Aug 2, 2016 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.