Solved

ping asa dmz or outside interface

Posted on 2014-12-03
4
526 Views
Last Modified: 2014-12-05
Hi

Im just wondering why i cant ping the dmz asa interface from a host on the "inside" LAN - my PC

The asa is in a 2 x failover. I can ping the failover dmz and outside interface IP's of the current "secondary" ASA  from my PC - only not the primary dmz + outside interfaces on the primary asa?

at the moment I have allow all access list outbound - so its not ACL. I am pinging from a higher security interface "inside" to a lower security DMZ interface. - I tried a packet trace from asdm - and it failed on route. dont quite get this as the DMz interface is direct attached interface + subnet. I suspect im just misunderstanding something basic about asa - Id like to know what please anyone ?  :)
0
Comment
Question by:philb19
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:Fidelius
ID: 40480552
As you have failover configuration, both ASA's should have identical configuration. If you can ping secondary addresses and not primary, I would suspect something is wrong with primary ASA.
Did you try to reboot primary ASA?
If you make force switchover to secondary ASA, can you ping DMZ and outside interfaces?

Regards!
0
 

Author Comment

by:philb19
ID: 40480571
thanks for posting - nothing appears to be wrong as such with traffic flow. What did change is I moved the dmz interfaces "of both" ASA's to new cisco switch. This does not explain why i cant ping the primary outside interface. but can to the outside on the 2ndary. To be honest I cant recall if I could ping the primary interfaces before the change - I was thinking he change would possibly be arp related

i didnt reboot the primary no. When I swapped the primary dmz interface - the asa did a failover. Then  To failback i simply did the same thing on the "new" primary - that is remove and insert back in the DMZ int.
it failed back then to the original primary. - all @ work is ok - Im just trying to get an understanding - thanks
0
 
LVL 12

Accepted Solution

by:
Fidelius earned 500 total points
ID: 40480707
To trigger failover you can use following commands:
On standby unit:
hostname# failover active
Forces a failover when entered on the standby unit in a failover pair. The standby unit becomes the active unit.
OR
On active unit:
hostname# no failover active
Forces a failover when entered on the active unit in a failover pair. The active unit becomes the standby unit.

No need to unplug cables.
Try to do failover and then ping to see how it behaves. On failover, secondary unit will takeover primary MAC and IP address. It should work in any case.

Sometimes, something can stuck in memory or on some of internal processes, so reboot is usually good to resolve such transient issues.
0
 

Author Closing Comment

by:philb19
ID: 40484183
awesome thanks
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question