2

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but interesting thing i can ping from PC A to 10.10.1.1 interface.

SL are Security Level

enter image description here

Result:

  1. from PC A to PC B - Ping successful
  2. from PC A to ASA interface 10.20.1.1 - Ping Failed
  3. from PC A to ASA interface 10.10.1.1 - Ping Failed
2

It is confused as you wrote "but interesting thing i can ping from PC A to 10.10.1.1 interface." and in the Result you wrote: "3. from PC A to ASA interface 10.10.1.1 - Ping Failed"

With Cisco ASA, you CANNOT ping other ASA interfaces rather than the one you are on.

That means from PC A (10.30.1.100) you CAN ping 10.30.1.1 (Interface IP with SL 100) and CANNOT ping 10.20.1.1 (Interface IP with SL 75) or 10.10.1.1 (Interface IP with SL 50).

Updated answer:

Looks like the real reason is not publicly revealed (or there is no real reason at all :), but I personally think it could be for security purposes ). It is just how Cisco Firewall is degined (since PIX Firewall).

You can find the latest information at here. And I hope this answers your question.

  • I think you are right we can't ping distinct interface of ASA but in Router it does work, Can anyone explain why what is the reason behind that to not allowing ping of distinct interface? – Satish Oct 19 '17 at 13:38
  • @Satish I have updated the answer to address this concern. – Hung Tran Oct 19 '17 at 21:03
2

As per what Hung said....

The adaptive security appliance only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.

Details can be found in the following reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/i1.html#wp1697623

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.