I have following scenario where i am trying to ping from PC to ASA interface not pinging but i can ping so why ASA not allowing to ping distinct interface but interesting thing i can ping from PC A to interface.

SL are Security Level

enter image description here


  1. from PC A to PC B - Ping successful
  2. from PC A to ASA interface - Ping Failed
  3. from PC A to ASA interface - Ping Failed

It is confused as you wrote "but interesting thing i can ping from PC A to interface." and in the Result you wrote: "3. from PC A to ASA interface - Ping Failed"

With Cisco ASA, you CANNOT ping other ASA interfaces rather than the one you are on.

That means from PC A ( you CAN ping (Interface IP with SL 100) and CANNOT ping (Interface IP with SL 75) or (Interface IP with SL 50).

Updated answer:

Looks like the real reason is not publicly revealed (or there is no real reason at all :), but I personally think it could be for security purposes ). It is just how Cisco Firewall is degined (since PIX Firewall).

You can find the latest information at here. And I hope this answers your question.

  • I think you are right we can't ping distinct interface of ASA but in Router it does work, Can anyone explain why what is the reason behind that to not allowing ping of distinct interface? – Satish Oct 19 '17 at 13:38
  • @Satish I have updated the answer to address this concern. – Hung Tran Oct 19 '17 at 21:03

As per what Hung said....

The adaptive security appliance only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.

Details can be found in the following reference:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.