ASA cannot ping outside through NAT on border router

Question

I have the following topology below, in GNS3. Basically, the cloud NAT-1 is the Internet, R1 is my border router with NAT and FWASAv-1 was supposed to be able to access the Internet, but can't. I created that other leg with R2 to test the NAT, and to my surprise, that one works fine. Here is the relevant config:

[Edit]

ASA --- R1 --- Internet --- google DNS (8.8.8.8)

From ASA, I´m trying to ping google DNS.

R1

R1#sh run
!
interface FastEthernet0/0
 ip address 172.16.31.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address dhcp
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
ip nat inside source list 10 interface FastEthernet0/1 overload
!
access-list 10 permit any

R1#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            172.16.31.1     YES NVRAM  up                    up      
FastEthernet0/1            192.168.122.106 YES DHCP   up                    up      
FastEthernet1/0            10.0.0.1        YES NVRAM  up                    up      
NVI0                       172.16.31.1     YES unset  up                    up  
! -- I don't know what that NVI0 is


R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.122.1 to network 0.0.0.0

C    192.168.122.0/24 is directly connected, FastEthernet0/1
     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.31.0 is directly connected, FastEthernet0/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, FastEthernet1/0
S*   0.0.0.0/0 [254/0] via 192.168.122.1

R1#ping 192.168.122.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.122.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/15/40 ms
R1#ping 8.8.8.8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/32 ms

  [1]: https://i.stack.imgur.com/yLtFj.png

R2

R2#sh run
!
ip name-server 192.168.122.1
!
interface FastEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 [1/0] via 10.0.0.1

R2#ping 10.0.0.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/13/24 ms

R2#ping 192.168.122.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.122.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 24/28/32 ms

R2#ping 8.8.8.8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 36/46/56 ms

FWASAv-1

ASAv1# sh run ip
!
interface GigabitEthernet0/0
 nameif inside
 security-level 100
 ip address 172.16.0.1 255.255.255.0 
!
interface GigabitEthernet0/1
 nameif dmz
 security-level 50
 ip address 172.16.10.1 255.255.255.0 
!
interface GigabitEthernet0/6
 nameif outside
 security-level 0
 ip address 172.16.31.2 255.255.255.0 
!
ASAv1# sh run route
route outside 0.0.0.0 0.0.0.0 172.16.31.1 1
! --- I don't know what those deny below are for
ASAv1# sh run xlate 
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
!
ASAv1#  ping 192.168.122.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.122.1, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASAv1# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASAv1# ping 172.16.31.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.31.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/10/10 ms

Debug in R1 (debug ip nat)

! When successfully pinging 8.8.8.8 from R1
*Mar  1 01:38:32.039:  mapping pointer available mapping:0
*Mar  1 01:38:32.039: NAT: [0] Allocated Port for 10.0.0.2 -> 192.168.122.106: wanted 21 got 21
*Mar  1 01:38:32.043: NAT: i: icmp (10.0.0.2, 21) -> (8.8.8.8, 21) [86]     
*Mar  1 01:38:32.043: NAT: s=10.0.0.2->192.168.122.106, d=8.8.8.8 [86]
*Mar  1 01:38:32.075: NAT: o: icmp (8.8.8.8, 21) -> (192.168.122.106, 21) [35052]     
*Mar  1 01:38:32.075: NAT: s=8.8.8.8, d=192.168.122.106->10.0.0.2 [35052]
*Mar  1 01:38:32.095: NAT: i: icmp (10.0.0.2, 21) -> (8.8.8.8, 21) [87]     
*Mar  1 01:38:32.095: NAT: s=10.0.0.2->192.168.122.106, d=8.8.8.8 [87]
*Mar  1 01:38:32.127: NAT: o: icmp (8.8.8.8, 21) -> (192.168.122.106, 21) [35081]     
*Mar  1 01:38:32.127: NAT: s=8.8.8.8, d=192.168.122.106->10.0.0.2 [35081]
*Mar  1 01:38:32.131: NAT: i: icmp (10.0.0.2, 21) -> (8.8.8.8, 21) [88]     
*Mar  1 01:38:32.131: NAT: s=10.0.0.2->192.168.122.106, d=8.8.8.8 [88]
*Mar  1 01:38:32.167: NAT: o: icmp (8.8.8.8, 21) -> (192.168.122.106, 21) [35115]     
*Mar  1 01:38:32.167: NAT: s=8.8.8.8, d=192.168.122.106->10.0.0.2 [35115]
*Mar  1 01:38:32.187: NAT: i: icmp (10.0.0.2, 21) -> (8.8.8.8, 21) [89]     
*Mar  1 01:38:32.187: NAT: s=10.0.0.2->192.168.122.106, d=8.8.8.8 [89]
*Mar  1 01:38:32.215: NAT: o: icmp (8.8.8.8, 21) -> (192.168.122.106, 21) [35153]     
*Mar  1 01:38:32.215: NAT: s=8.8.8.8, d=192.168.122.106->10.0.0.2 [35153]
*Mar  1 01:38:32.223: NAT: i: icmp (10.0.0.2, 21) -> (8.8.8.8, 21) [90]     
*Mar  1 01:38:32.227: NAT: s=10.0.0.2->192.168.122.106, d=8.8.8.8 [90]
*Mar  1 01:38:32.255: NAT: o: icmp (8.8.8.8, 21) -> (192.168.122.106, 21) [35187]     
*Mar  1 01:38:32.255: NAT: s=8.8.8.8, d=192.168.122.106->10.0.0.2 [35187]

! When pinging 8.8.8.8 from ASAv and failing
*Mar  1 01:39:59.387:  mapping pointer available mapping:0
*Mar  1 01:39:59.387: NAT: [0] Allocated Port for 172.16.31.2 -> 192.168.122.106: wanted 56364 got 56364
*Mar  1 01:39:59.391: NAT*: i: icmp (172.16.31.2, 56364) -> (8.8.8.8, 56364) [7968]
*Mar  1 01:39:59.391: NAT*: i: icmp (172.16.31.2, 56364) -> (8.8.8.8, 56364) [7968]
*Mar  1 01:39:59.391: NAT*: s=172.16.31.2->192.168.122.106, d=8.8.8.8 [7968]
R1#
*Mar  1 01:40:01.415:  mapping pointer available mapping:0
*Mar  1 01:40:01.415: NAT: [0] Allocated Port for 172.16.31.2 -> 192.168.122.106: wanted 56365 got 56365
*Mar  1 01:40:01.415: NAT*: i: icmp (172.16.31.2, 56365) -> (8.8.8.8, 56365) [15738]
*Mar  1 01:40:01.419: NAT*: i: icmp (172.16.31.2, 56365) -> (8.8.8.8, 56365) [15738]
*Mar  1 01:40:01.419: NAT*: s=172.16.31.2->192.168.122.106, d=8.8.8.8 [15738]
R1#
*Mar  1 01:40:03.399:  mapping pointer available mapping:0
*Mar  1 01:40:03.399: NAT: [0] Allocated Port for 172.16.31.2 -> 192.168.122.106: wanted 56366 got 56366
*Mar  1 01:40:03.399: NAT*: i: icmp (172.16.31.2, 56366) -> (8.8.8.8, 56366) [22464]
*Mar  1 01:40:03.403: NAT*: i: icmp (172.16.31.2, 56366) -> (8.8.8.8, 56366) [22464]
*Mar  1 01:40:03.403: NAT*: s=172.16.31.2->192.168.122.106, d=8.8.8.8 [22464]
R1#
*Mar  1 01:40:05.403:  mapping pointer available mapping:0
*Mar  1 01:40:05.403: NAT: [0] Allocated Port for 172.16.31.2 -> 192.168.122.106: wanted 56367 got 56367
*Mar  1 01:40:05.403: NAT*: i: icmp (172.16.31.2, 56367) -> (8.8.8.8, 56367) [29396]
*Mar  1 01:40:05.407: NAT*: i: icmp (172.16.31.2, 56367) -> (8.8.8.8, 56367) [29396]
*Mar  1 01:40:05.407: NAT*: s=172.16.31.2->192.168.122.106, d=8.8.8.8 [29396]
R1#
*Mar  1 01:40:07.407:  mapping pointer available mapping:0
*Mar  1 01:40:07.407: NAT: [0] Allocated Port for 172.16.31.2 -> 192.168.122.106: wanted 56368 got 56368
*Mar  1 01:40:07.407: NAT*: i: icmp (172.16.31.2, 56368) -> (8.8.8.8, 56368) [2676]
*Mar  1 01:40:07.411: NAT*: i: icmp (172.16.31.2, 56368) -> (8.8.8.8, 56368) [2676]
*Mar  1 01:40:07.411: NAT*: s=172.16.31.2->192.168.122.106, d=8.8.8.8 [2676]

I also captured traffic between R1 and Switch1. When ping comes from R2, packets show up there already translated. When pinged from ASA, no icmp packets show up there.

Is it something in ASA? I don't know what else to do. I can provide more configurations, debug, what not.

Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. — Ron Maupin, Apr 1, 2018 at 22:54
Hello, I don´t know why my topology was not inserted in my answer, but the ASA is not in the middle here, it is the source. I´m editing the question to show the topology. — Adriano_epifas, Apr 25, 2018 at 20:40
I found a solution by changing the ASA object inside GNS3, my answer will clear it up. — Adriano_epifas, Apr 25, 2018 at 20:40

Travis · Accepted Answer · 2018-03-29 20:06:16Z

1

Ping (icmp) by default is not allowed through a Cisco ASA and you need to create a rule on the outside->in to allow icmp to respond. Cisco ASA is a statefull firewall except for ping.

answered Mar 29, 2018 at 20:06

Travis

111 bronze badge

Cisco ASA is not in the middle of the connection here. It is actually starting the ping
– Adriano_epifas
Apr 25, 2018 at 20:41

Add a comment |

Adriano_epifas · Accepted Answer · 2018-04-25 20:51:47Z

0

So, my question was answered at Cisco website. Basically I was using IOSv image for ASA and img image for the router. They were conflicting somehow. When I changed both to IOSv it worked fine.

answered Apr 25, 2018 at 20:51

Adriano_epifas

1315 bronze badges

Please accept your answer so that the question doesn't keep popping up forever, looking for an answer.
– Ron Maupin ♦
Apr 25, 2018 at 22:28

Add a comment |

Stack Exchange Network

ASA cannot ping outside through NAT on border router

2 Answers 2

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco-asa
nat
ping
gns3
traffic
or ask your own question.

Hot Network Questions

ASA cannot ping outside through NAT on border router

2 Answers 2

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco-asanatpinggns3traffic or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco-asa
nat
ping
gns3
traffic
or ask your own question.