07-02-2010 11:38 AM - edited 03-11-2019 11:07 AM
I have DMZ interface with 192.168.1.0\24with the following config on the firewall:
nat (dmz) 2 192.168.1.0 255.255.255.0
global (outside) 2 <publicIP>
the dmz interface on the firewall is 192.168.1.1 and it can ping all dmz servers, so routing is not the issue
and no access-group for the dmz interface.
yet dmz servers are unable to access the internet.
is there anything missing in this config?
when I run a capture I see the traffic hitting the dmz interface yet nothing coming back, ie:
158: 06:27:07.126000 192.168.1.13 > 4.2.2.2: icmp: echo request
159: 06:27:12.625822 192.168.1.13 > 4.2.2.2: icmp: echo request
160: 06:27:18.125771 192.168.1.13 > 4.2.2.2: icmp: echo request
161: 06:27:23.625639 192.168.1.13 > 4.2.2.2: icmp: echo request
162: 06:27:29.125573 192.168.1.13 > 4.2.2.2: icmp: echo request
07-02-2010 01:14 PM
Looks good from my point.
Please check the security lvl of your interfaces.
Maybe you need to assign a higher security lvl to your DMZ interface
HTH (if so please rate )
cheers Michael
07-02-2010 03:52 PM
If you are testing with ping, please make sure that icmp inspection has been turned on/enabled.
If you are using the default policy map on the ASA, the configuration will be as follows:
policy-map global_policy
class inspection_default
inspect icmp
Hope that helps.
07-05-2010 09:48 PM
Have you enabled ICMP traffic on the outside interface of the firewall? If no, please try "icmp permit any outside". Also, which firewall you are using? Is it 5505? If it is 5505, you might have license limitations.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide