I am working on a project to allow ICMP through the firewall from the outside interface to an inside interface. I have configured the firewall to inspect icmp and allowed icmp through access-list for the subnets and hosts then bound it to the outside and inside interfaces and still can't get through. I have two computers connected directly to the firewall outside and inside ports. Here is the config:

Int Eth0/1
Int Eth0/2
switchport access vlan 2

interface Vlan1
nameif inside
security-level 100
ip address
interface Vlan2
name if outside
security-level 50
ip address
access-list ALLOW_ICMP extended permit icmp any any echo-reply

access-group ALLOW_ICMP in interface outside
access-group ALLOW_ICMP out interface outside 
access-group ALLOW_ICMP in interface inside 
access-group ALLOW _ICMP  out interface inside

policy-map global_policy 
class inspection_default
inspect icmp 
inspect icmp error
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15, 2017 at 2:46

2 Answers 2


Your access list allow only echo-reply, but not requests.

Also Cisco ASA is statefull firewall, so you don't need your access list applied on every interface, only on outside interface. When icmp inspection is enabled, return traffic for session is allowed by default.

access-list ALLOW_ICMP extended permit icmp any any echo
access-group ALLOW_ICMP in interface outside
  • I am not sure why my traffic is being blocked from a higher security level to a lower one. I can ping the interfaces or the same security level. Sep 14, 2016 at 18:10

You should allow echo request from outside. In current ACL you are allowing only returning traffic(reply).

  • Thanks for the replies. My problem still persists. I cannot ping the host on the higher security level or vice versa, only the interfaces. Sep 14, 2016 at 18:08
  • Have you disabled nat-control? Sep 14, 2016 at 19:38
  • Yes. I set the firewall back to factory default since it is used, typed in no nat-control removed DHCP pool then put in static ip's in for the inside and outside VLAN's. Sep 14, 2016 at 20:23
  • On the configuration build I did see nat (inside) 1 I am not sure if that could be causing issues. Sep 14, 2016 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.