Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1733
  • Last Modified:

PAT, ping and ASA5520

Got to allow pings from a specific server to my global pat address.  The Outside interface has an address, and I've allowed pings to that.  The address that I use for PAT is not the same as that configured on Outside interface of my ASA.  How would I allow a specific server to ping that?
0
dcyberdoc
Asked:
dcyberdoc
  • 2
1 Solution
 
Istvan KalmarHead of IT Security Division Commented:
Hi,


Please refer this page howto do it:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008046f31a.shtml#s11

you need to enable echo on outside ACL

Best regards,
Istvan
0
 
dcyberdocAuthor Commented:
First and foremost, thanks for taking the time to reply.  

Sadly, that is not the solution to my particular quandary and I must have been unclear on my issue.  I did find that document, but it didn't really address my particular situation.

I have enabled icmp echo on the outside interface.  The outside IP is ???.???.???.42.  The global pat ip is ???.???.???..8.  I CAN ping the outside interface - .42 - from the server I'm allowing icmp from (which I couldn't when I started this exercise).  I cannot ping the .8 address.

here are some relevant configs:

!
interface GigabitEthernet0/0
 description Trunk
 no nameif
 security-level 0
 no ip address
!
interface GigabitEthernet0/0.100
 vlan xxx
 nameif outside
 security-level 0
 ip address ???.???.???.42 255.255.255.0 standby ???.???.???.43
!

icmp permit any echo-reply outside
icmp permit any outside

global (outside) 1 ???.???.???.8

access-list from-outside extended permit icmp host xxx.xxx.xxx.9 host ???.???.???.8 echo
access-list from-outside extended permit icmp host xxx.xxx.xxx.9 host ???.???.???..8 echo-reply

access-group from-outside in interface outside

Once again, thanks for your help.  
0
 
lrmooreCommented:
You cannot get there from here.
You cannot ping a dynamic address that is not assigned to an interface.
Your global address is a dynamic PAT address.
PAT address is only used to set up specific connections for outbound traffic and the translation is only made for the specific port requiring it, and only for the duration required to complete the connection.
In order for a natted IP to respond to a ping, there must be a static xlate to an internal host that will respond.
Since ICMP has no concept of individual ports, you cannot port-forward just icmp to an internal host, and keep the rest dynamic.


0
 
dcyberdocAuthor Commented:
When you can't, you can't.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now