ASA not allowing ping to distinct interface IP

Question

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but interesting thing i can ping from PC A to 10.10.1.1 interface.

SL are Security Level

Result:

1. from PC A to PC B - Ping successful
2. from PC A to ASA interface 10.20.1.1 - Ping Failed
3. from PC A to ASA interface 10.10.1.1 - Ping Failed

Answer 1

It is confused as you wrote "but interesting thing i can ping from PC A to 10.10.1.1 interface." and in the Result you wrote: "3. from PC A to ASA interface 10.10.1.1 - Ping Failed"

With Cisco ASA, you CANNOT ping other ASA interfaces rather than the one you are on.

That means from PC A (10.30.1.100) you CAN ping 10.30.1.1 (Interface IP with SL 100) and CANNOT ping 10.20.1.1 (Interface IP with SL 75) or 10.10.1.1 (Interface IP with SL 50).

Updated answer:

Looks like the real reason is not publicly revealed (or there is no real reason at all :), but I personally think it could be for security purposes ). It is just how Cisco Firewall is degined (since PIX Firewall).

You can find the latest information at here. And I hope this answers your question.

Answer 2

As per what Hung said....

The adaptive security appliance only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.

Details can be found in the following reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/i1.html#wp1697623