October 14, 2008 12:27am pdt

My Account

Top 15 Experts

Overall Top Experts

1lrmoore 8,550
2rafael_acc 3,005
3harbor235 2,900
4yasirirfan 2,800
5Frabble 2,600
6donjohnston 2,500
6rsivanandan 2,500
8PennGwyn 2,300
9sunnycoder 2,200
10blu 2,150
11mikebernh... 2,075
12leew 2,000
12AdriendeC 2,000
12giltjr 2,000
12renill 2,000

	[x] Attachment Details

Simple Command to disable icmp on External Interface

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.9

Zones: Network Routers, Internet Control Message Protocol (ICMP), Cisco PIX Firewall

Tags: Cisco, 2811 Router, Advanced IP services, Used as a VPN Endpoint

Hello all and thanks for any suggestions you may have.

The Cisco ASA (5500) has a simple command to disable and enable ICMP on its interfaces

icmp deny any outside
icmp permit any inside

Is there a very simple way to disable pings (icmp) on an external Interface.

I've attached my config (actually) from an 871 but the IOS level is similar and virtually the same except for the interfaces.

Thanks all

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:

           
           
             70WEST#sh run
Building configuration...
 
Current configuration : 2241 bytes
 
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
 
hostname 70WEST
 
boot-start-marker
boot-end-marker
 
enable secret 5 xxxxxxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
 
no aaa new-model
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.2.2.1 10.2.2.19
ip dhcp excluded-address 10.2.2.51 10.2.2.255
 
ip dhcp pool WESTPOOL
   network 10.2.2.0 255.255.255.0
   default-router 10.2.2.1
   domain-name xxxxxxxxxx.com
   dns-server 10.1.10.20 10.1.10.23
   netbios-name-server 10.1.10.23
 
 
no ip domain lookup
 
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key xxxxx address x.x.x.x no-xauth
 
crypto ipsec security-association lifetime seconds 86400
 
crypto ipsec transform-set aes256-1 esp-3des esp-md5-hmac
 
crypto map outside-map-1 1 ipsec-isakmp
 set peer x.x.x.x
 set transform-set aes256-1
 match address 101
 
interface FastEthernet0
 
interface FastEthernet1
 
interface FastEthernet2
 
interface FastEthernet3
 
interface FastEthernet4
 ip address x.x.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map outside-map-1
 
interface Vlan1
 ip address 10.2.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 
ip default-gateway x.x.x.x
ip route 0.0.0.0 0.0.0.0 x.x.x.x name DEFAULT_ROUTE
 
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet4 overload
 
ip access-list extended outside_cryptomap_1
 permit ip 10.2.2.0 0.0.0.255 any
 
access-list 95 permit x.x.x.x
access-list 95 permit x.x.x.x
access-list 95 permit 10.1.8.0 0.0.3.255
access-list 100 deny   ip 10.2.2.0 0.0.0.255 10.1.8.0 0.0.3.255
access-list 100 permit ip 10.2.2.0 0.0.0.255 any
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.8.0 0.0.3.255
access-list 150 permit ip 10.2.2.0 0.0.0.255 any
dialer-list 1 protocol ip permit
 
 
 
control-plane
 
 
line con 0
 no modem enable
line aux 0
line vty 0 4
 access-class 95 in
 password 7 xxxxxxxxxxxxx
 logging synchronous
 login
 transport input telnet ssh
 
scheduler max-task-time 5000
end
 
70WEST#

           
         

	#	Title
	1	Cisco ASA interface issues with VPN
	2	ICMP Traffic Silently Dropped for NONA…
	3	Cisco ASA Not passing traffic (possi…
	4	ASA5510: Definitely a translation i…
	5	Cisco ASA 5510 Basic Config
	6	ICMP to external URLs fails