3

I am working on a project to allow ICMP through the firewall from the outside interface to an inside interface. I have configured the firewall to inspect icmp and allowed icmp through access-list for the subnets and hosts then bound it to the outside and inside interfaces and still can't get through. I have two computers connected directly to the firewall outside and inside ports. Here is the config:

Int Eth0/1
!
Int Eth0/2
switchport access vlan 2

interface Vlan1
nameif inside
security-level 100
ip address 192.168.5.12 255.255.255.0
!
interface Vlan2
name if outside
security-level 50
ip address 192.168.6.1 255.255.255.0
!
access-list ALLOW_ICMP extended permit icmp any any echo-reply

access-group ALLOW_ICMP in interface outside
access-group ALLOW_ICMP out interface outside 
access-group ALLOW_ICMP in interface inside 
access-group ALLOW _ICMP  out interface inside

policy-map global_policy 
class inspection_default
inspect icmp 
inspect icmp error
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 2:46
2

Your access list allow only echo-reply, but not requests.

Also Cisco ASA is statefull firewall, so you don't need your access list applied on every interface, only on outside interface. When icmp inspection is enabled, return traffic for session is allowed by default.

access-list ALLOW_ICMP extended permit icmp any any echo
access-group ALLOW_ICMP in interface outside
  • I am not sure why my traffic is being blocked from a higher security level to a lower one. I can ping the interfaces or the same security level. – Andrew Lowry Sep 14 '16 at 18:10
0

You should allow echo request from outside. In current ACL you are allowing only returning traffic(reply).

  • Thanks for the replies. My problem still persists. I cannot ping the host on the higher security level or vice versa, only the interfaces. – Andrew Lowry Sep 14 '16 at 18:08
  • Have you disabled nat-control? – Nuran Afrasiyabov Sep 14 '16 at 19:38
  • Yes. I set the firewall back to factory default since it is used, typed in no nat-control removed DHCP pool then put in static ip's in for the inside and outside VLAN's. – Andrew Lowry Sep 14 '16 at 20:23
  • On the configuration build I did see nat (inside) 1 0.0.0.0 0.0.0.0 I am not sure if that could be causing issues. – Andrew Lowry Sep 14 '16 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.