cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4961
Views
5
Helpful
4
Replies

ASA/PIX not responding to Pings from Outside interface

Charlie Mayes
Level 1
Level 1

                       I need a ASA/PIX firewall to respond to my ping eneting the outside interface from a specific subnet. Is this ACL correctly written to do that?

                       access-list 101 permit icmp 76.X.X.X 255.255.255.192 any echo-reply
                       access-group 101 in interface outside

2 Accepted Solutions

Accepted Solutions

Jon Marshall
Hall of Fame
Hall of Fame

iketurner931 wrote:

                       I need a ASA/PIX firewall to respond to my ping eneting the outside interface from a specific subnet. Is this ACL correctly written to do that?

                       access-list 101 permit icmp 76.X.X.X 255.255.255.192 any echo-reply
                       access-group 101 in interface outside

An acl allows ping through the firewall not to the firewall.

You need this instead -

icmp permit 76.x.x.x 255.255.255.192 echo-reply outside

however by default an ASA should respond to ping on it's interfaces anyway so you need to check your config.

Note also that you cannot ping across the ASA to an interface so if you are outside you can ping the outside interface but not any of the others.

Jon

View solution in original post

iketurner931 wrote:

               Thanks Jon,

                                 Are you saying that the Pix by default will not respond to pings but the ASA will?

No, the pix should respond by default to pings as well.

Jon

View solution in original post

4 Replies 4

Jon Marshall
Hall of Fame
Hall of Fame

iketurner931 wrote:

                       I need a ASA/PIX firewall to respond to my ping eneting the outside interface from a specific subnet. Is this ACL correctly written to do that?

                       access-list 101 permit icmp 76.X.X.X 255.255.255.192 any echo-reply
                       access-group 101 in interface outside

An acl allows ping through the firewall not to the firewall.

You need this instead -

icmp permit 76.x.x.x 255.255.255.192 echo-reply outside

however by default an ASA should respond to ping on it's interfaces anyway so you need to check your config.

Note also that you cannot ping across the ASA to an interface so if you are outside you can ping the outside interface but not any of the others.

Jon

               Thanks Jon,

                                 Are you saying that the Pix by default will not respond to pings but the ASA will?

iketurner931 wrote:

               Thanks Jon,

                                 Are you saying that the Pix by default will not respond to pings but the ASA will?

No, the pix should respond by default to pings as well.

Jon

                          Ok Thanks.

Review Cisco Networking products for a $25 gift card