Our internet access works perfectly ok from a NAT & PAT & ACL stand point... only thing is that we cannot ping & traceroute to the Internet.

I have a permit ip any any on all traffic incoming the INSIDE interface. Is that sufficient or do I need to apply the following as well:

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

I just ran a packet capture, results:

RESULTS - The packet is dropped

Info : (rpf violated) Reverse-path verify failed

I tried to remove the following but still unable to ping:

ip verify reverse-path interface Outside

ip verify reverse-path interface Inside

If you're using the asa, you also need to configure the ICMP inspection using the icmp permit command set;

e.g.

icmp permit any inside

icmp permit echo-reply outside

icmp permit unreachable outside

icmp permit traceroute outside

HTH

P-J Nefkens

Hi,

The above lines need to be applied on the outside interface.

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-group 101 in interface outside

OR

The other option is to enable inspection:

For example:

policy-map global_policy

class inspection_default

inspect icmp

Please refer the below URL for details:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Regards,

Arul

*Pls rate if it helps*