I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface.

No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/advice on how to resolve this.

Below is the setup/config:

Router | vlan 300| -------- ASA | vlan 300|

ASA interface config and ACL:

 interface GigabitEthernet1/2
  no nameif
  security-level 100
  no ip address

 interface GigabitEthernet1/2.2
  vlan 300
  nameif inside
  security-level 100
  ip address

   access-list inside_access_in extended permit ip any any
   access-list inside_access_in extended permit icmp any any
   access-list inside_access_out extended permit ip any any
   access-list inside_access_out extended permit icmp any any
   access-group inside_access_in in interface inside
   access-group inside_access_out out interface inside

  # packet-tracer input inside icmp 8 0 detailed

   Phase: 1
   Subtype: Resolve Egress Interface
   Result: ALLOW
   Additional Information:
   found next-hop using egress ifc  inside

   Phase: 2
   Result: DROP
   Implicit Rule
   Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7f1a5004b610, priority=501, domain=permit, deny=true
    hits=5, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
    src ip/id=, mask=, port=0, tag=any
    dst ip/id=, mask=, port=0, tag=any, dscp=0x0
    input_ifc=inside, output_ifc=any

   input-interface: inside
   input-status: up
   input-line-status: up
   output-interface: inside
   output-status: up
   output-line-status: up
   Action: drop
   Drop-reason: (acl-drop) Flow is denied by configured rule

Im not sure why this is immediately dropping? I have a tcpdump listener in between, and the interface sends 0 packets, no arp, nothing.

When my router tries the ping i see the arp requested on the listener with no replies:

   10:16:17.018288 ARP, Request who-has tell, length 46
  • There's a separate command (I forget what it is off the top of my head) you need to allow ICMP.
    – Ron Trunk
    Oct 15, 2020 at 17:37
  • @RonTrunk Are you thinking of the deprecated command "fixup icmp"?
    – Jesse P.
    Oct 16, 2020 at 0:40
  • @JesseP. No. It’s ICMP inspection, or something like that
    – Ron Trunk
    Oct 16, 2020 at 2:11
  • @RonTrunk Yep. That's what the fixup command did. It was just a shortcut to adding the icmp inspection to the policy-map/class-map definitions. The command was "fixup protocol icmp". You can manually add the same configurations to the policy-map/class-map directly, though. I don't think the fixup command works at all in some of the newer code levels.
    – Jesse P.
    Oct 16, 2020 at 2:51
  • At any rate, @fizgriz, if you can post the output of show run policy-map that should tell us what we need to know about which protocols you're currently inspecting. Better yet, if you can post the full sanitized config, it will help make sure we have all of the pieces we might need.
    – Jesse P.
    Oct 16, 2020 at 2:55

1 Answer 1


Traffic sourced or received from the ASA is not subject to regular ACLs you would also need ICMP allow entries in place.


icmp permit host echo-reply inside

icmp permit host echo inside

If other traffic is entering and exiting the same zone you would also need a statement to allow intrazone traffic which is disabled by default.

same-security-traffic permit intra-interface

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.