Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Once again about pinging ASA's Outside interface from Internal network

Dear all,

recently I faced a problem when we launched HP OV monitoring system. It is required to ping all enabled interfaces on ASA. "Inside" interface is monitored well but "Outside" is unavailable by ICMP and due to this alarm generated. I know that PIX's and ASA's with 7.x versions of software don't allow to do this (this is clearly noticed in documentation, here for example). But in documentation for version 8.2 (actually this version software installed now) I can't find any information regarding this question. I wonder if I missed something and such function was enabled in recent versions of software?


Cheers,
Dmitriy

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Once again about pinging ASA's Outside interface from Intern

Hi Dmitriy,

Jitendriya is correct--it is still not possible to ping a far-side interface on the ASA. This is by design and cannot be changed due to security restrictions. Here is the documentation for 8.2 that outlines this:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i1.html#wp1697623

The adaptive security appliance only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface. 

Hope that helps.

-Mike

5 REPLIES
Cisco Employee

Re: Once again about pinging ASA's Outside interface from Intern

i think its still not possible but i can confirm on that, its more of a security feature which doesnt let u ping accross the asa and dont htin kthat would change

in any case i can confirm tht

Cisco Employee

Re: Once again about pinging ASA's Outside interface from Intern

Hi Dmitriy,

Jitendriya is correct--it is still not possible to ping a far-side interface on the ASA. This is by design and cannot be changed due to security restrictions. Here is the documentation for 8.2 that outlines this:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i1.html#wp1697623

The adaptive security appliance only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface. 

Hope that helps.

-Mike

New Member

Re: Once again about pinging ASA's Outside interface from Intern

Hello,

Take a look here, maybe you know it:

management-access

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/m_72.html#wp1794331

What is the feedback?

Best regards

Cisco Employee

Re: Once again about pinging ASA's Outside interface from Intern

That’s is only to access the interface on the other side through the vpn tunnel

The idea behind this is since you are using vpn to get in through the outside, there is no reason why I should be denying you from accessing the firewall using my inside ip because ideally vpn means internal (network that u trust) so they are like your inside

This feature is mainly introduced to manage the firewall through the vpn

This command works only for the vpn traffic and also you can configure only 1 interface as management-access

Hope this helps

New Member

Re: Once again about pinging ASA's Outside interface from Intern

Thanks a lot to all of you, guys. I will keep in mind that this is not possible.

Best regrads,

Dmitriy

271
Views
5
Helpful
5
Replies
CreatePlease to create content