1

Hi guys I am trying to get ping from a inside host to outside host, i have posted my topology below, can someone please provide the correct configuration so i can do this? thank you.

enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 14:52
3

Rather than configuring an ACL, you could just add ICMP to the default inspection class. I can't remember the exact name, but in global configuration there will be a default policy map called something like default inspection. This default inspection policy calls a class map that includes all the protocols that are inspected by default. You need to add ICMP into that class.

It'll go something like this:

policy-map <policy_name>
  class-map <class_name>
    inspect icmp
  • These are the names if you want to add them in: policy-map global_policy, class inspection_default. Also I would add that you need "inspect icmp error" as well for traceroute. – Chris Balmer Aug 9 '16 at 1:51
  • It should be noted that inspect is the only acceptable way of allowing echo-reply through the ASA. ACLs should never be used on an outside interface for ICMP. If you would like to learn more information about this particular inspect rule please see the official resouce: cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/… – Brian Winning Jr. Aug 12 '16 at 2:42
  • @BrianWinningJr. why is inspection the only acceptable way? What dangers does allowing icmp-echo-reply inbound on the outside interface cause? (curious) – Mark Aug 12 '16 at 9:56
  • @Mark without inspection there is no way to ensure there is only one response for every request and that the sequence number is correct. This opens up a network to ICMP attacks. To clarify I am talking specifically about echo-reply. – Brian Winning Jr. Aug 12 '16 at 10:07
  • @BrianWinningJr. Ahh.. thanks. When you say ICMP attacks, are you talking about floods in attempt to deny service or something else? – Mark Aug 12 '16 at 12:21
0

If I remember correctly:

access-list <acl_name> extended permit <protocol> <source> <destination> <port>

access-group <acl_name> <inbound/outbound> <interface>

You should be able to get the rest by yourself though... Cisco has some good resources you should read up on. Configuration guides and such

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.