Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Ping from DMZ to Outside1 Networks

Dear friends, I have an ASA 5510, but cannot ping from DMZ to Outside1 Networks (I am trying to ping 172.1.1.x, that is located on a cisco 892 router connected to interface Outside1). cannot ping viceversa too. I have the same scenario from Inside to Outside1 but it works fine

Does someone can help me?

Here's my config 

ASA Version 8.2(1)

!

hostname ASAFCHFW

domain-name farmaciachavez.com.bo

enable password xxxxxx encrypted

passwd xxxxxxxx encrypted

names

!

interface Ethernet0/0

 nameif Outside

 security-level 0

 ip address x.y.z.162 255.255.255.248

!

interface Ethernet0/1

 nameif Outside1

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Ethernet0/2

 nameif DMZ

 security-level 10

 ip address 172.16.31.1 255.255.255.0

!

interface Ethernet0/3

 nameif Inside

 security-level 100

 ip address 192.168.0.1 255.255.255.0

!

interface Management0/0

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0

 management-only

!

boot system disk0:/asa821-k8.bin

ftp mode passive

dns server-group DefaultDNS

 domain-name farmaciachavez.com.bo

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list dmz_in extended permit tcp host 172.16.31.2 any eq domain

access-list dmz_in extended permit tcp host 172.16.31.2 any eq smtp

access-list dmz_in extended permit tcp host 172.16.31.2 any eq www

access-list dmz_in extended permit tcp host 172.16.31.2 any eq https

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 3000

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 1000

access-list Inside extended permit ip any any

access-list Inside extended permit icmp any any

access-list 100 extended permit tcp any host x.y.z.163 eq smtp

access-list 100 extended permit udp any host x.y.z.163 eq domain

access-list 100 extended permit tcp any host x.y.z.163 eq https

access-list 100 extended permit tcp any host x.y.z.163 eq www

access-list 100 extended permit tcp any host x.y.z.163 eq 3000

access-list 100 extended permit tcp any host x.y.z.163 eq 1000

pager lines 24

logging enable

logging buffered debugging

logging asdm informational

mtu Outside 1500

mtu Outside1 1500

mtu DMZ 1500

mtu Inside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit host 192.168.0.22 Outside

icmp permit 192.168.0.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 Outside1

icmp permit 172.16.31.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 Inside

icmp permit 192.168.0.0 255.255.255.0 Inside

icmp permit 172.16.31.0 255.255.255.0 Inside

asdm image disk0:/asdm-647.bin

asdm history enable

arp timeout 14400

global (Outside) 101 interface

nat (Outside1) 101 0.0.0.0 0.0.0.0

nat (DMZ) 101 0.0.0.0 0.0.0.0

nat (Inside) 101 0.0.0.0 0.0.0.0

static (DMZ,Outside) x.y.z.163 172.16.31.0 netmask 255.255.255.255

static (DMZ,Inside) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Inside,Outside1) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

static (DMZ,Outside1) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,DMZ) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.2.0 172.1.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.3.0 172.1.3.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0

static (Outside1,DMZ) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

access-group 100 in interface Outside

access-group dmz_in in interface DMZ

route Outside 0.0.0.0 0.0.0.0 x.y.z.161 20

route Outside1 172.1.1.0 255.255.255.0 192.168.2.2 1

route Outside1 172.1.2.0 255.255.255.0 192.168.2.2 1

route Outside1 192.1.0.0 255.255.192.0 192.168.2.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 192.168.0.0 255.255.255.0 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 192.168.0.0 255.255.255.0 Inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:4eeab15a30414454def2931f5957382e

: end

 

 

3 REPLIES

Hi, the security level of DMZ

Hi, the security level of DMZ is lower than your Outside1, this is why you will need to specify ACL to allow icmp from that specific host or you can also use icmp command. 

The reason you are able to to ping from Inside to Outside1 is because their security level is the same and you have that same security command configured.

New Member

Dea Rudy, I am alittle bit

Dea Rudy, I am alittle bit newbie on this. Can yo help me designing an ACL for any kind of traffic from DMZ to Outside1 and viceversa please. 

New Member

Dear Rudy, I was inspecting

Dear Rudy, I was inspecting my configuration and I see the following curious behavior. I have 2 interfaces 100 security level (Inside and Outside1), also 1 Interface with 0 Security level (Outside) and 1 with 10 Security Level (DMZ). I have fluent traffic between DMZ and Inside bi-directionally but don't have any traffic between DMZ and Outside1. Why? what's missing in the configuration.

 

: Saved

:

ASA Version 8.2(1)

!

hostname ASAFCHFW

domain-name farmaciachavez.com.bo

enable password 6Jfo5anznhoG00fM encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

 nameif Outside

 security-level 0

 ip address x.y.z.162 255.255.255.248

!

interface Ethernet0/1

 nameif Outside1

 security-level 100

 ip address 192.168.2.1 255.255.255.0

!

interface Ethernet0/2

 nameif DMZ

 security-level 10

 ip address 172.16.31.1 255.255.255.0

!

interface Ethernet0/3

 nameif Inside

 security-level 100

 ip address 192.168.0.1 255.255.255.0

!

interface Management0/0

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0

 management-only

!

boot system disk0:/asa821-k8.bin

ftp mode passive

dns server-group DefaultDNS

 domain-name farmaciachavez.com.bo

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list dmz_in extended permit tcp host 172.16.31.2 any eq domain

access-list dmz_in extended permit tcp host 172.16.31.2 any eq smtp

access-list dmz_in extended permit tcp host 172.16.31.2 any eq www

access-list dmz_in extended permit tcp host 172.16.31.2 any eq https

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 3000

access-list dmz_in extended permit tcp host 172.16.31.2 any eq 1000

access-list Inside extended permit ip any any

access-list Inside extended permit icmp any any

access-list 100 extended permit tcp any host x.y.z.163 eq smtp

access-list 100 extended permit udp any host x.y.z.163 eq domain

access-list 100 extended permit tcp any host x.y.z.163 eq https

access-list 100 extended permit tcp any host x.y.z.163 eq www

access-list 100 extended permit tcp any host x.y.z.163 eq 3000

access-list 100 extended permit tcp any host x.y.z.163 eq 1000

pager lines 24

logging enable

logging buffered debugging

logging asdm informational

mtu Outside 1500

mtu Outside1 1500

mtu DMZ 1500

mtu Inside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit host 192.168.0.22 Outside

icmp permit 192.168.0.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 Outside1

icmp permit 172.16.31.0 255.255.255.0 Outside1

icmp permit 192.168.2.0 255.255.255.0 DMZ

icmp permit 192.168.2.0 255.255.255.0 Inside

icmp permit 192.168.0.0 255.255.255.0 Inside

icmp permit 172.16.31.0 255.255.255.0 Inside

asdm image disk0:/asdm-647.bin

asdm history enable

arp timeout 14400

global (Outside) 101 interface

nat (Outside1) 101 0.0.0.0 0.0.0.0

nat (DMZ) 101 0.0.0.0 0.0.0.0

nat (Inside) 101 0.0.0.0 0.0.0.0

static (DMZ,Outside) x.y.z.163 172.16.31.0 netmask 255.255.255.255

static (DMZ,Inside) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Inside,Outside1) 192.168.0.0 192.168.0.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

static (DMZ,Outside1) 172.16.31.0 172.16.31.0 netmask 255.255.255.0

static (Outside1,DMZ) 192.168.2.0 192.168.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.2.0 172.1.2.0 netmask 255.255.255.0

static (Outside1,Inside) 172.1.3.0 172.1.3.0 netmask 255.255.255.0

static (Outside1,Inside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0

static (Outside1,DMZ) 172.1.1.0 172.1.1.0 netmask 255.255.255.0

access-group dmz_in in interface DMZ

route Outside 0.0.0.0 0.0.0.0 x.y.z.161 20

route Outside1 172.1.1.0 255.255.255.0 192.168.2.2 1

route Outside1 172.1.2.0 255.255.255.0 192.168.2.2 1

route Outside1 172.1.3.0 255.255.255.0 192.168.2.2 1

route Outside1 192.1.0.0 255.255.192.0 192.168.2.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 192.168.0.0 255.255.255.0 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 192.168.0.0 255.255.255.0 Inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:7441424d1fcf87c3eb837b569e84aa9e

: end

23
Views
0
Helpful
3
Replies