Solved

Ping ASA firewall Outside interface

Posted on 2014-12-09
16
298 Views
Last Modified: 2014-12-10
on the topology shown below, I can ping from the computer(192.168.61.1) all the way to inside interface of ASA 192.168.62.6.

However I cannot ping neither from the computer nor from  router1 to outside interface of ASA(20.20.20.20)
Anything missing ?

Thank you


below is the routing table of R1 and ASA
R1#sh ip route
 

Gateway of last resort is 192.168.62.6 to network 0.0.0.0

C    192.168.62.0/24 is directly connected, GigabitEthernet1/0
C    192.168.61.0/24 is directly connected, GigabitEthernet0/0
S*   0.0.0.0/0 [1/0] via 192.168.62.6
R1#

Open in new window


ciscoasa# sh route

 
Gateway of last resort is not set

C    192.168.62.0 255.255.255.0 is directly connected, inside
S    192.168.61.0 255.255.255.0 [1/0] via 192.168.62.5, inside
C    20.20.20.0 255.255.255.0 is directly connected, outside

Open in new window








pi
0
Comment
Question by:jskfan
  • 9
  • 6
16 Comments
 
LVL 50

Accepted Solution

by:
Don Johnston earned 333 total points
ID: 40488770
From a routing perspective, it looks fine.

Is the ASA doing NAT?  
Are you allowing the traffic on the ASA?  

Really need to see the ASA config to identify the issue.
0
 

Author Comment

by:jskfan
ID: 40488821
This is the ASA configuration

ciscoasa# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address 192.168.62.6 255.255.255.0
!
interface GigabitEthernet1
 nameif outside
 security-level 0
 ip address 20.20.20.20 255.255.255.0
!
interface GigabitEthernet2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network Network62
 subnet 192.168.62.0 255.255.255.0
access-list ACL-OUTSIDE extended permit icmp any any
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo inside
icmp permit any echo-reply inside
no asdm history enable
arp timeout 14400
access-group ACL-OUTSIDE in interface outside
route inside 192.168.61.0 255.255.255.0 192.168.62.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.61.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!
!
policy-map global_policy
policy-map global-policy
 class class-default
  inspect icmp
!
service-policy global-policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:3b65f2ce05efb0d88d2783fb3579890e
: end
ciscoasa#

Open in new window

0
 
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 167 total points
ID: 40489678
The ASA needs an outside route?

route outside 0.0.0.0 0.0.0.0 20.20.20.30

PL
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40489847
access-group ACL-OUTSIDE in interface outside

There's no corresponding ACL.
0
 

Author Comment

by:jskfan
ID: 40489926
There is a line in the code:
access-list ACL-OUTSIDE extended permit icmp any any
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40490005
Sorry.  Not enough caffeine today.

And I also realized you're trying to ping the outside interface of the ASA. That won't work.  You should, however, be able to ping 20.20.20.30
0
 

Author Comment

by:jskfan
ID: 40490021
Sorry.  Not enough caffeine today.
Nap Time...

I cannot ping 20.20.20.30 ...
I have added another ACL, but still cannot ping:

access-list ACL-OUTSIDE extended permit icmp any any
access-list ACL-INSIDE extended permit icmp any any
access-group ACL-INSIDE out interface inside
access-group ACL-OUTSIDE in interface outside
0
 

Author Comment

by:jskfan
ID: 40490024
I wonder if it needs NAT?
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 333 total points
ID: 40490037
I can't see why NAT would be required.  Then again, I've never setup an ASA that didn't have NAT configured.  So it would be interesting to try that.
0
 

Author Comment

by:jskfan
ID: 40490178
I thought ACL will be enough...

I am not sure how NAT should be configured in this case
0
 

Author Comment

by:jskfan
ID: 40491417
Packet Tracer show ICMP packets allowed but, when I ping from the router I do not get the reply.

I have added loop back on R2 with IP=30.30.30.30 , I can ping it from ASA but cannot ping it from R1
However when I trace( through Packet Tracer) from R1 Gig0/0 interface( facing computer C1) to Loopback interface of R2 (30.30.30.30), it shows Packet allowed.

pt
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40491443
Packet Tracer show ICMP packets allowed but, when I ping from the router I do not get the reply.
You have two routers.  You need to specify which router.  And what is the destination?

when I trace (through Packet Tracer) from R1 Gig0/0 interface (facing computer C1) to Loopback interface of R2 (30.30.30.30), it shows Packet allowed.
Well that tells you the ASA is allowing the traffic. Which leads me to wonder if R2 has a route to the destination.
Have you tried pinging from the ASA but sourcing the traffic from g0?
0
 

Author Comment

by:jskfan
ID: 40491489
Don:
I found out the Solution, I had to use NAT and now I can ping from R1 to Loopback of R2
 
R1#ping 30.30.30.30

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 30.30.30.30, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/31/64 ms
R1#

Open in new window


I flowed this link :http://resources.intenseschool.com/cisco-asa-in-gns3-network-connectivity-using-nat-rules/
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40491505
Good job!
0
 

Author Comment

by:jskfan
ID: 40491568
Just for whoever is running with the same issue:

in addition to using NAT , I had to enable ICMP inspection.
Both NAT and ICMP inspection were done through ASDM.
Below is full configuration of ASA for my Scenario :


ciscoasa(config)# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address 192.168.62.6 255.255.255.0
!
interface GigabitEthernet1
 nameif outside
 security-level 0
 ip address 20.20.20.20 255.255.255.0
!
interface GigabitEthernet2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network Inside-Network
 subnet 192.168.62.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network Inside-Network
 nat (any,outside) dynamic interface
route outside 30.30.30.0 255.255.255.0 20.20.20.30 5
route inside 192.168.61.0 255.255.255.0 192.168.62.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.61.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
class-map global-class
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global-policy
 class global-class
  inspect icmp
!
service-policy global-policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:bfd051876e39938fe3ea3277e3d76877
: end

Open in new window

0
 

Author Closing Comment

by:jskfan
ID: 40491574
Thank you Guys!!
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now