Hi guys I am trying to get ping from a inside host to outside host, i have posted my topology below, can someone please provide the correct configuration so i can do this? thank you.
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Aug 14, 2017 at 14:52
Add a comment
|
2 Answers
Rather than configuring an ACL, you could just add ICMP to the default inspection class. I can't remember the exact name, but in global configuration there will be a default policy map called something like default inspection. This default inspection policy calls a class map that includes all the protocols that are inspected by default. You need to add ICMP into that class.
It'll go something like this:
policy-map <policy_name>
class-map <class_name>
inspect icmp
-
These are the names if you want to add them in: policy-map global_policy, class inspection_default. Also I would add that you need "inspect icmp error" as well for traceroute. Aug 9, 2016 at 1:51
-
It should be noted that inspect is the only acceptable way of allowing echo-reply through the ASA. ACLs should never be used on an outside interface for ICMP. If you would like to learn more information about this particular inspect rule please see the official resouce: cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/… Aug 12, 2016 at 2:42
-
@BrianWinningJr. why is inspection the only acceptable way? What dangers does allowing icmp-echo-reply inbound on the outside interface cause? (curious)– MarkAug 12, 2016 at 9:56
-
@Mark without inspection there is no way to ensure there is only one response for every request and that the sequence number is correct. This opens up a network to ICMP attacks. To clarify I am talking specifically about echo-reply. Aug 12, 2016 at 10:07
-
@BrianWinningJr. Ahh.. thanks. When you say ICMP attacks, are you talking about floods in attempt to deny service or something else?– MarkAug 12, 2016 at 12:21
If I remember correctly:
access-list <acl_name> extended permit <protocol> <source> <destination> <port>
access-group <acl_name> <inbound/outbound> <interface>
You should be able to get the rest by yourself though... Cisco has some good resources you should read up on. Configuration guides and such
