<div>
<div class="content wysiwyg-content">
Hi the topology is like this: User PC (wireless) ----- switch1 ---- swithch2 -----(inside)ASA. All switch are layer3 switch.<br />
Switch1, switch2 and ASA can ping each other. PC, switch1 and swich2 also can ping each other. but the PC and ASA cannot ping each other. When PC ping ASA, the ASA can get debug message &quot;ICMP echo request from (PC ip address)&quot; but not &quot;ICMP echo reply from...&quot;<br />
<br />
I think the issue is in switch. Do you think so ? Thank you
</div>
</div>


Hi the topology is like this: User PC (wireless) ----- switch1 ---- swithch2 -----(inside)ASA. All switch are layer3 switch.
Switch1, switch2 and ASA can ping each other. PC, switch1 and swich2 also can ping each other. but the PC and ASA cannot ping each other. When PC ping ASA, the ASA can get debug message "ICMP echo request from (PC ip address)" but not "ICMP echo reply from..."

I think the issue is in switch. Do you think so ? Thank you

Where is the problem when user cannot ping ASA inside ?

Cisco PIX is a dedicated hardware firewall appliance; the Cisco Adaptive Security Appliance (ASA) is a firewall and anti-malware security appliance that provides unified threat management and protection the PIX does not. Other Cisco devices and systems include routers, switches, storage networking, wireless and the software and hardware for PIX Firewall Manager (PFM), PIX Device Manager (PDM) and Adaptive Security Device Manager (ASDM).

Cisco

A switch is a device that filters and forwards packets of data between LAN segments. Switches operate at the data link layer or the network layer of the Open Systems Interconnection (OSI) Reference Model and therefore support any packet protocol. LANs that use switches to join segments are called switched LANs or, in the case of Ethernet networks, switched Ethernet LANs. A hub is a connection point for devices in a network. Hubs are commonly used to connect segments of a LAN. A hub contains multiple ports; when a packet arrives at one port, it is copied to the other ports so that all segments of the LAN can see all packets.