Im (remotely) working with an issue where the network has intermittent drops. i suspect possible routing loop, but havent confirmed that yet.

In the logs of our Cisco ASA 5506, i see that the public gateway is continuously pinging computers on the internal network. The ICMP requests are getting denied (as expected), so PC's are not sending a response ping back.

My question is, how does the ISP router know that the internal network even exists? Its my understanding that the firewall should be natting the internal to the public IP, so the router should only see the Public IP address. If the ISP router was accidentally connected directly to the internal network via switch, would the ASA still be able to see and block the ICMP requests? This is the only ASA in deployment that i am seeing this behavior.

Let me know if theres anymore information i can provide

Physical setup:

ISP Fiber Router --> ASA ge1/1 (outside)

ASA ge1/2 (inside) --> NetGear switch --> Cisco switch (switches connect to patch panel)

ASA routing config:

route outside ISP GATEWAY 1 track 1

NAT Config

nat (any,outside) dynamic interface

  • 2
    You need to provide a sanitized config of the ASA and an example of the log entries you’re seeing, as well as a diagram and explanation of why you suspect a loop.
    – Jesse P.
    Oct 29 at 13:29