[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 357
  • Last Modified:

Ping ASA firewall Outside interface

on the topology shown below, I can ping from the computer(192.168.61.1) all the way to inside interface of ASA 192.168.62.6.

However I cannot ping neither from the computer nor from  router1 to outside interface of ASA(20.20.20.20)
Anything missing ?

Thank you


below is the routing table of R1 and ASA
R1#sh ip route
 

Gateway of last resort is 192.168.62.6 to network 0.0.0.0

C    192.168.62.0/24 is directly connected, GigabitEthernet1/0
C    192.168.61.0/24 is directly connected, GigabitEthernet0/0
S*   0.0.0.0/0 [1/0] via 192.168.62.6
R1#

Open in new window


ciscoasa# sh route

 
Gateway of last resort is not set

C    192.168.62.0 255.255.255.0 is directly connected, inside
S    192.168.61.0 255.255.255.0 [1/0] via 192.168.62.5, inside
C    20.20.20.0 255.255.255.0 is directly connected, outside

Open in new window








pi
0
jskfan
Asked:
jskfan
  • 9
  • 6
3 Solutions
 
Don JohnstonInstructorCommented:
From a routing perspective, it looks fine.

Is the ASA doing NAT?  
Are you allowing the traffic on the ASA?  

Really need to see the ASA config to identify the issue.
0
 
jskfanAuthor Commented:
This is the ASA configuration

ciscoasa# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address 192.168.62.6 255.255.255.0
!
interface GigabitEthernet1
 nameif outside
 security-level 0
 ip address 20.20.20.20 255.255.255.0
!
interface GigabitEthernet2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network Network62
 subnet 192.168.62.0 255.255.255.0
access-list ACL-OUTSIDE extended permit icmp any any
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo inside
icmp permit any echo-reply inside
no asdm history enable
arp timeout 14400
access-group ACL-OUTSIDE in interface outside
route inside 192.168.61.0 255.255.255.0 192.168.62.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.61.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!
!
policy-map global_policy
policy-map global-policy
 class class-default
  inspect icmp
!
service-policy global-policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:3b65f2ce05efb0d88d2783fb3579890e
: end
ciscoasa#

Open in new window

0
 
Pete LongConsultantCommented:
The ASA needs an outside route?

route outside 0.0.0.0 0.0.0.0 20.20.20.30

PL
0
Big Data Means Big Business

In data-dependent industries like IT, finance, and healthcare, there’s a growing demand for qualified analysts to fill leadership roles. WGU’s MS in Data Analytics has IT certifications from Oracle and SAS built into its curriculum at a flat fee that could save you money.

 
Don JohnstonInstructorCommented:
access-group ACL-OUTSIDE in interface outside

There's no corresponding ACL.
0
 
jskfanAuthor Commented:
There is a line in the code:
access-list ACL-OUTSIDE extended permit icmp any any
0
 
Don JohnstonInstructorCommented:
Sorry.  Not enough caffeine today.

And I also realized you're trying to ping the outside interface of the ASA. That won't work.  You should, however, be able to ping 20.20.20.30
0
 
jskfanAuthor Commented:
Sorry.  Not enough caffeine today.
Nap Time...

I cannot ping 20.20.20.30 ...
I have added another ACL, but still cannot ping:

access-list ACL-OUTSIDE extended permit icmp any any
access-list ACL-INSIDE extended permit icmp any any
access-group ACL-INSIDE out interface inside
access-group ACL-OUTSIDE in interface outside
0
 
jskfanAuthor Commented:
I wonder if it needs NAT?
0
 
Don JohnstonInstructorCommented:
I can't see why NAT would be required.  Then again, I've never setup an ASA that didn't have NAT configured.  So it would be interesting to try that.
0
 
jskfanAuthor Commented:
I thought ACL will be enough...

I am not sure how NAT should be configured in this case
0
 
jskfanAuthor Commented:
Packet Tracer show ICMP packets allowed but, when I ping from the router I do not get the reply.

I have added loop back on R2 with IP=30.30.30.30 , I can ping it from ASA but cannot ping it from R1
However when I trace( through Packet Tracer) from R1 Gig0/0 interface( facing computer C1) to Loopback interface of R2 (30.30.30.30), it shows Packet allowed.

pt
0
 
Don JohnstonInstructorCommented:
Packet Tracer show ICMP packets allowed but, when I ping from the router I do not get the reply.
You have two routers.  You need to specify which router.  And what is the destination?

when I trace (through Packet Tracer) from R1 Gig0/0 interface (facing computer C1) to Loopback interface of R2 (30.30.30.30), it shows Packet allowed.
Well that tells you the ASA is allowing the traffic. Which leads me to wonder if R2 has a route to the destination.
Have you tried pinging from the ASA but sourcing the traffic from g0?
0
 
jskfanAuthor Commented:
Don:
I found out the Solution, I had to use NAT and now I can ping from R1 to Loopback of R2
 
R1#ping 30.30.30.30

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 30.30.30.30, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/31/64 ms
R1#

Open in new window


I flowed this link :http://resources.intenseschool.com/cisco-asa-in-gns3-network-connectivity-using-nat-rules/
0
 
Don JohnstonInstructorCommented:
Good job!
0
 
jskfanAuthor Commented:
Just for whoever is running with the same issue:

in addition to using NAT , I had to enable ICMP inspection.
Both NAT and ICMP inspection were done through ASDM.
Below is full configuration of ASA for my Scenario :


ciscoasa(config)# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address 192.168.62.6 255.255.255.0
!
interface GigabitEthernet1
 nameif outside
 security-level 0
 ip address 20.20.20.20 255.255.255.0
!
interface GigabitEthernet2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network Inside-Network
 subnet 192.168.62.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network Inside-Network
 nat (any,outside) dynamic interface
route outside 30.30.30.0 255.255.255.0 20.20.20.30 5
route inside 192.168.61.0 255.255.255.0 192.168.62.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.61.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
class-map global-class
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global-policy
 class global-class
  inspect icmp
!
service-policy global-policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:bfd051876e39938fe3ea3277e3d76877
: end

Open in new window

0
 
jskfanAuthor Commented:
Thank you Guys!!
0

Featured Post

Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

  • 9
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now