07-05-2013 02:35 AM - edited 03-11-2019 07:07 PM
I'm currently trying to set up a failover network for my Cisco ASA 55x0 using the SLA traking. I have the "outside" interface (network 89.x.x.48/29) and the "outside2" interface (network 192.168.70.0/24).
track 1 rtr 1 reachability
sla monitor 1
type echo protocol ipIcmpEcho 89.x.x.49 interface outside
sla monitor schedule 1 start-time now life forever
route outside 0.0.0.0 0.0.0.0 89.x.x.49 128 track 1
As you can see I set up the ping on IP 89.x.x.49, this one reply when I try to ping from my computer that is in the "inside" network:
$ ping 89.x.x.49
Pinging 89.x.x.49 with 32 bytes of data:
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Ping statistics for 89.x.x.49:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
In the picture there is my problem: seems there is a rule on the Cisco that block all the echo-replies from the ip 89.x.x.49 to the firewall, despite I can reach it using my computer and it can reply to my computer.
Solved! Go to Solution.
07-05-2013 02:57 AM
Hi,
This is the culprit:
icmp deny any outside
just do this:
config t
icmp permit 89.x.x 49 255.255.255.255 outside
Regards
Alain
Don't forget to rate helpful posts.
07-05-2013 02:36 AM
Here the capture on the outside interface, the behavior seems correct, but the Cisco ASA always denies all the echo-replies toward it.
07-05-2013 02:41 AM
Hi,
Can you post sh run icmp output.
Regards
Alain
Don't forget to rate helpful posts.
07-05-2013 02:50 AM
firewall# sh run icmp
icmp unreachable rate-limit 1 burst-size 1
icmp deny any outside
I think you found where is my problem :-)
07-05-2013 02:57 AM
Hi,
This is the culprit:
icmp deny any outside
just do this:
config t
icmp permit 89.x.x 49 255.255.255.255 outside
Regards
Alain
Don't forget to rate helpful posts.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: