1

I am doing a very simple lab with one asa and two computers. PC1 connected to dms PC2 connected to outside

: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.6(1)
!
[omitted]
!
interface GigabitEthernet1/1
 nameif dms
 security-level 100
 ip address 100.0.10.2 255.255.255.252
!
interface GigabitEthernet1/2
 nameif outside
 security-level 0
 ip address 100.10.9.5 255.255.255.252
!
[omitted]
!
access-list PING extended permit icmp any any
!
access-group PING in interface dms
access-group PING out interface dms
access-group PING in interface outside
access-group PING out interface outside
access-group PING global

There is no problem when trying to ping from PC1 to firewall. However I could not ping from PC2 to anywhere

YKS(config)# packet-tracer input dms icmp 100.0.10.1 1 2 3 100.10.9.5

Result:
Action: drop

It does not show any reason, drop or otherwise. As far as I know it should have a reason to drop. In my case it is just drop. How do I troubleshoot with this issue?

  • I think it is because you are dealing with ICMP which terminates at an interface on the Asa. In addition to your ACL, you need to permit to the interface with this command “ICMP permit 100.0.10.0 255.255.255.0 outside” see cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/… for full syntax. If you confirm I will upgrade comment to answer. – Darrell Root Feb 12 at 2:26
  • Also try a packet tracer through your Asa rather than ending on the Asa. Might get more useful data. – Darrell Root Feb 12 at 2:27
  • I tried the icmp permit thing and it works, then packet tracer through asa also works after that. I just wonder why there is no phase or reason when I used packet tracer at that moment. – chiajw1 Feb 14 at 2:27
1

It is because you are dealing with ICMP which terminates at an interface on the Asa. In addition to your ACL, you need to permit to the interface with this command

“icmp permit 100.0.10.0 255.255.255.0 outside”

See cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/… for full syntax.

Yes it is annoying that on the ASA you need to execute this magic command to get pinging to work. I'm afraid we all learned it the hard way. ;-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.