ASA 5525 version 8.6

Hi,

 

I am using ASA 5525 with 8.6 version, and I am trying to ping through different interfaces, However I am not able to do that. My test results are

 

    - can PING between the outside interface and the next hop (same subnet)

    - cannot PING between the inside interface and the next hop (same subnet)

    - cannot PING between the DMZ interface and the next hop (same subnet)

 

 

Please see below configuration for firewall for reference.

--------------------------------------------------------------------------------

 

 

interface GigabitEthernet0/0

speed 100

duplex full

nameif outside

security-level 0

ip address 16.x.x.x 255.255.255.248

 

 

interface GigabitEthernet0/1

no nameif

security-level 0

no ip address

!

interface GigabitEthernet0/1.16

vlan 16

nameif inside

security-level 100

ip address 17.x.x.x 255.255.255.0

 

 

interface GigabitEthernet0/3

no nameif

security-level 0

no ip address

!

interface GigabitEthernet0/3.69

vlan 69

nameif dmz

security-level 50

ip address 18.x.x.x 255.255.255.0

 

 

2.     access-list o_inside extended permit icmp any any

        access-list o_inside extended permit icmp any any echo

 

        access-list o_inside extended permit icmp 17.x.x.x (Inside interface) 255.255.0.0 18.x.x.x (DMZ interface) 255.255.255.0  

        access-list o_inside extended permit icmp 17.x.x.x (Inside interface) 255.255.0.0 18.x.x.x (DMZ interface) 255.255.255.0

 

        access-list o_dmz extended permit icmp any any

        access-list outside extended permit icmp any any

        access-list outside extended permit icmp any any echo-reply

 

        icmp permit any outside

        icmp permit any dmz

 

        policy-map global_policy

        class inspection_default

 

               inspect icmp

               inspect icmp error

 

 

 

3.         route inside 17.x.0.0 (Whole inside interface subnet) 255.255.0.0 17.x.x.x (Internal Network) 1

            route dmz 17.x.x.0 (Internal) 255.255.255.0 18.x.x.x (DMZ Nework) 1

            route outside 18.x.x.0 (DMZ) 255.255.255.0 16.x.x.x (Outside Network) 1

 

 

If possible could anyone please tell me what is wrong with the configuration, and what I need to add to achive the above desired result.

 

Thank You,

Kind Regards
C-o-MAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

eeRootCommented:
Does the log show any blocked icmp traffic when you are doing the ping tests?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
C-o-MAuthor Commented:
No I can not see anything. When I tried to see the Arp table it is empty as well, I can only see the outside interface which it can ping.

Thanks
0
harbor235Commented:
I see access lists defined but not activated via access-group commands? Are these ACLs active?


harbor235 :}
0
C-o-MAuthor Commented:
Helped in Troubleshooting
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.