inside host asa cannot ping high security level

[sokmeng.min]

Dear All,

Please help. I have an cisco ASA5512 which configure to access the internet, but very wonder that why my inside host pc cannot ping to outside interface ip which I set as security level 0?. Please quide to me how to allow them to access the outside interface.

Thanks and Best regard,

[Marius Gunnerud]

By default you will not be able to ping an ASA interface that is not the ingress interface.  If you want to be able to ping the outside interface from an inside host you would need to add the following command (just change the inside IP/subnet to the required value):

icmp permit 192.168.1.0 255.255.255.0 outside

--

Please remember to rate and select a correct answer

[sokmeng.min]

Dear Marius Gunnerud,

Many thanks for your reply, but I was try this command:

icmp permit 192.168.1.0 255.255.255.0 outside

icmp permit any outside

icmp permit any outside echo

icmp permit any outside echo-reply

--

and your also, but it didn't work. Can you give me any suggestion?

Thanks and Best regard,

[Marius Gunnerud · Accepted solution]

I correct my previous statement.

the icmp permit command is only so that you do not have to add an ACL to the interface to deny or allow ICMP request/reply on that specific ingress interface.

the ASA will not allow ping to another interface that is not the ingress interface.  there is no way around this.

--

Please remember to rate and select a correct answer

[Rudy Sanjoko · Accepted solution]

From what I understand, you will not be able to ping outside interface of ASA from any hosts behind inside interface, ASA will not allow this by design. The only ping allowed is to the nearest interface of the ASA, e.g. ping to ASA inside interface from hosts behind inside interface or ping to ASA DMZ interface from hosts behind the DMZ interface.