Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Unable to ping loopback IP of switch From PC connected to ASA Inside interface

 

Hi Everyone,

Here is setup

Switch -------------------------ASA1----Active

                                         ASA1----Standby

 

ASA is config as Active/Standby

ASA has dhcp config that provides PC with IP 10.0.0.11

 

From Switch i can ping my PC

1#ping 10.0.0.11

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/9 ms

 

Switch info
1#sh ip int brief
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  10.0.0.4        YES NVRAM  up                    up
FastEthernet1/0/1      unassigned      YES unset  up                    up
FastEthernet1/0/2      unassigned      YES unset  up                    up
FastEthernet1/0/3      unassigned      YES unset  down                  down
FastEthernet1/0/4      unassigned      YES unset  down                  down
FastEthernet1/0/5      unassigned      YES unset  down                  down
FastEthernet1/0/6      unassigned      YES unset  down                  down
FastEthernet1/0/7      unassigned      YES unset  down                  down
FastEthernet1/0/8      unassigned      YES unset  down                  down
FastEthernet1/0/9      unassigned      YES unset  down                  down
FastEthernet1/0/10     unassigned      YES unset  down                  down
FastEthernet1/0/11     unassigned      YES unset  down                  down
FastEthernet1/0/12     unassigned      YES unset  down                  down
FastEthernet1/0/13     unassigned      YES unset  down                  down
FastEthernet1/0/14     unassigned      YES unset  down                  down
FastEthernet1/0/15     unassigned      YES unset  down                  down
FastEthernet1/0/16     unassigned      YES unset  down                  down
FastEthernet1/0/17     unassigned      YES unset  down                  down
FastEthernet1/0/18     unassigned      YES unset  down                  down
FastEthernet1/0/19     unassigned      YES unset  down                  down
FastEthernet1/0/20     unassigned      YES unset  down                  down
FastEthernet1/0/21     unassigned      YES unset  down                  down
FastEthernet1/0/22     unassigned      YES unset  down                  down
FastEthernet1/0/23     unassigned      YES unset  down                  down
FastEthernet1/0/24     unassigned      YES unset  down                  down
GigabitEthernet1/0/1   unassigned      YES unset  administratively down down
GigabitEthernet1/0/2   unassigned      YES unset  administratively down down
Loopback0              10.1.0.1        YES NVRAM  up                    up
Loopback1              10.1.1.1        YES NVRAM  up                    up
Loopback2              10.1.2.1        YES NVRAM  up                    up
Loopback3              10.1.3.1        YES NVRAM  up                    up
Loopback4              10.1.4.1        YES NVRAM  up                    up
Loopback5              10.1.5.1        YES NVRAM  up                    up
Loopback6              10.1.6.1        YES NVRAM  up                    up
Loopback7              192.168.50.1    YES NVRAM  up                    up
Loopback8              unassigned      YES NVRAM  up                    up
R1#

 

ASA has Vlan 1 as inside interface with IP 10.0.0.1 and has direct connection to switch on vlan 1.

From ASA i can ping the 10.1.0.1

ASA1#                             ping 10.1.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

 

From  PC i can not ping IP 10.1.0.1

Logs from ASA

May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

ASA  info

ASA1# sh int
ASA1# sh interface ip brief
Interface                  IP-Address      OK? Method Status                Protocol
Ethernet0/0                unassigned      YES unset  up                    up
Ethernet0/1                unassigned      YES unset  up                    up
Ethernet0/2                unassigned      YES unset  up                    up
Ethernet0/3                unassigned      YES unset  down                  down
Ethernet0/4                unassigned      YES unset  up                    up
Ethernet0/5                unassigned      YES unset  up                    up
Ethernet0/6                unassigned      YES unset  administratively down down
Ethernet0/7                unassigned      YES unset  administratively down down
Internal-Data0/0           unassigned      YES unset  up                    up
Internal-Data0/1           unassigned      YES unset  up                    up
Vlan1                      10.0.0.1        YES CONFIG up                    up
Vlan2                      96.x.x.x.   YES manual up                    up
Vlan3                      10.12.12.1      YES CONFIG up                    up
Vlan30                     10.30.30.1      YES unset  up                    up
Virtual0                   127.1.0.1       YES unset  up                    up

 

Need to know why this ping is not working is this due to NAT also why ASA is looking for loopback IP of switch in outside direction?

 

Regards

MAhesh

2 ACCEPTED SOLUTIONS

Accepted Solutions

It looks like the issue is

It looks like the issue is that PC, switch and ASA are in the same network (10.0.0.0/24)

As far as I know, ASA does not send ICMP redirect messages; you can add a static route on the PC for the network 10.1.0.0 to go directly to switch instead of ASA; that will solve the issue for that PC only.

I think the best practice is to create a routing subnet between the switch and ASA:

PC - SWITCH in VLAN1

SWITCH - ASA in a new VLAN used for routing

that means you have to make the switch your default gateway for VLAN1 and change the IP of the inside interface of the ASA + change the routes...

check this link to understand ICMP redirects:

http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html

other forum posts discuss the same issue:

https://supportforums.cisco.com/discussion/11229301/icmp-redirect

Patrick

The reason patricks

The reason patricks suggestion worked is because the switch is also doing routing. So in this case the ping never goes through the firewall but instead directly between the pc and switch. -- Please remember to select a correct answer and rate
--

Please remember to rate and select a correct answer
19 REPLIES

Hi Mahesh,what's your netmask

Hi Mahesh,

what's your netmask on VLAN1?

you can try from the switch ping 10.0.0.11 source Lo0; does that work?

also please attach show route on ASA and switch (if it is a layer 3 switch)...

Patrick

Community Member

 Hi Patrick,Vlan1 has netmask

 

Hi Patrick,

Vlan1 has netmask 255.255.255.0

1#ping 10.0.0.14 source  loopback 0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.14, timeout is 2 seconds:
Packet sent with a source address of 10.1.0.1
.....
Success rate is 0 percent (0/5)


Above is ping from Switch to PC IP

 

Switch is layer 3

1#sh int vlan1
Vlan1 is up, line protocol is up
  Hardware is EtherSVI, address is 0011.bb5e.e240 (bia 0011.bb5e.e240)
  Internet address is 10.0.0.4/24


Route info

1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 8 subnets
C       10.1.3.0 is directly connected, Loopback3
C       10.1.2.0 is directly connected, Loopback2
C       10.1.1.0 is directly connected, Loopback1
C       10.0.0.0 is directly connected, Vlan1
C       10.1.0.0 is directly connected, Loopback0
C       10.1.6.0 is directly connected, Loopback6
C       10.1.5.0 is directly connected, Loopback5
C       10.1.4.0 is directly connected, Loopback4
C    192.168.50.0/24 is directly connected, Loopback7
S*   0.0.0.0/0 [1/0] via 10.0.0.1

 

ASA1# sh run route
route outside 0.0.0.0 0.0.0.0 96.51.148.1 1
route inside 10.1.0.0 255.255.0.0 10.0.0.4 1
route inside 192.168.50.0 255.255.255.0 10.0.0.4 1

 

Regards

Mahesh

Hall of Fame Super Silver

Mahesh,What's the default

Mahesh,

What's the default gateway for the PC? ("route print" from command prompt if it's a Windows host)

If it's not 10.0.0.1 on the ASA then your ping will fail.

Community Member

 Hi Marvin, PC has default

 

Hi Marvin,

 

PC has default gateway of 10.0.0.1

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\manveer>route print
===========================================================================
Interface List
 25...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter #2
 23...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter
 21...74 e5 0b 5b e7 88 ......Intel(R) WiFi Link 1000 BGN
 13...f0 bf 97 de 4f 48 ......Atheros AR8151 PCI-E Gigabit Ethernet Controller (
NDIS 6.20)
 12...94 39 e5 97 60 b5 ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.0.1        10.0.0.14     25
         10.0.0.0    255.255.255.0         On-link         10.0.0.14    281
        10.0.0.14  255.255.255.255         On-link         10.0.0.14    281
       10.0.0.255  255.255.255.255         On-link         10.0.0.14    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.0.0.14    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         10.0.0.14    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0     192.168.98.1  Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 21    281 fe80::/64                On-link
 21    281 fe80::f54f:db1d:f86:1184/128
                                    On-link
  1    306 ff00::/8                 On-link
 21    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

C:\Users\manveer>ipconfig

Windows IP Configuration


Wireless LAN adapter Wireless Network Connection 3:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::f54f:db1d:f86:1184%21
   IPv4 Address. . . . . . . . . . . : 10.0.0.14
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.0.1

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

 

Regards

Mahesh

try removing the persistent

try removing the persistent default route:

Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0     192.168.98.1  Default

Community Member

 Delete the persistent route

 

Delete the persistent route and did ping to 10.1.0.1 still same thing.

Logs from ASA

May 26 2014 15:15:08: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1

May 26 2014 15:15:10: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1

 

Hall of Fame Super Silver

I think you are getting

I think you are getting asymmetric routing since the switch is the same place your PC is attached.

Your PC pings an address on the 10.1.0.0 network. It sends it to the ASA (default gateway). ASA has a static route to that network so it sends the packet back to the switch. The switch receives the echo request and then creates a reply to the PC. At this point I believe the reply does not go via the ASA but instead tries and fails to go back to the PC via the switch's 10.0.0.4 address since a connected route takes priority over a static route (given the same prefix).

Try adding a static route in the switch to your PC address:

     route 10.0.0.14 255.255.255.255 10.0.0.1

That should force the return traffic via the ASA. Make sure you have "same-security-traffic intra-interface" enabled on the ASA. 

Community Member

 I config static route on

 

I config static route on switch

1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
S       10.0.0.14/32 [1/0] via 10.0.0.1
C       10.1.3.0/24 is directly connected, Loopback3
C       10.1.2.0/24 is directly connected, Loopback2
C       10.1.1.0/24 is directly connected, Loopback1
C       10.0.0.0/24 is directly connected, Vlan1
C       10.1.0.0/24 is directly connected, Loopback0
C       10.1.6.0/24 is directly connected, Loopback6
C       10.1.5.0/24 is directly connected, Loopback5
C       10.1.4.0/24 is directly connected, Loopback4
C    192.168.50.0/24 is directly connected, Loopback7
S*   0.0.0.0/0 [1/0] via 10.0.0.1

ASA is configured for same-security-traffic.

Still same thing.

After adding route to switch i can not  ping or telnet to switch IP 10.0.0.4 from

my pc.

I agree with Marvin that this

I agree with Marvin that this seems to be an asynchronous routing issue.  I do not think adding a static route will help, as connected routes will take precedence over the static route, and you will still have the same asynchronous routing issue.

Trying issuing a packet capture on the ASA for both the ingress and egress interfaces.  This should clear up if the return packets are reaching the ASA or not.  Post the output here if you require assistance with reading it.

--

Please remember to select a correct answer and rate

--

Please remember to rate and select a correct answer
Community Member

 Hi MArius, I config packet

 

Hi MArius,

 

I config packet capture on inside interface

here is output

ASA1# sh capture capin

4 packets captured

   1: 06:44:46.747169       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re                                                                                        quest
   2: 06:44:51.627378       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re                                                                                        quest
   3: 06:44:56.635724       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re                                                                                        quest
   4: 06:45:01.641995       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re                                                                                        quest

 

After this i also config packet capture for outside interface

 capture capin interface outside match ip host 10.0.0.18 host 10.1.0.1

 

ASA1# sh capture capin

12 packets captured

   1: 06:44:46.747169       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   2: 06:44:51.627378       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   3: 06:44:56.635724       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   4: 06:45:01.641995       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   5: 06:46:03.760153       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   6: 06:46:03.760489       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   7: 06:46:08.639340       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   8: 06:46:08.639676       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
   9: 06:46:13.636380       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
  10: 06:46:13.636716       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
  11: 06:46:18.627775       802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
  12: 06:46:18.628126       802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request

 

What does the above packet capture show?

 

Regards

MAhesh

This confirms Marvins, and

This confirms Marvins, and mine, theory that the ASA never sees the return packet from the switch.  Then when the PC sends another ICMP packet, the ASA sees that the packet is out of order and drops it as a spoofed packet. 

You could configure the ASA for TCP bypass, but it is not a recommended solution and if you do not have a direct requirement to be able to ping or reach the loopback you should not implement it.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html

--

Please remember to select a correct answer and rate

--

Please remember to rate and select a correct answer
Community Member

 Hi Marius, I am trying to

 

Hi Marius,

 

I am trying to understand the packet flow from PC to switch loopback.

Seems as per logs ASA is looking for Switch loopback IP in outside direction right?

May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1

 

So ASA is sending packet in outside direction instead of inside right?

As there is no host on outside connection thats the reason ping is not working?

 

Regards

MAhesh

 

It looks like the issue is

It looks like the issue is that PC, switch and ASA are in the same network (10.0.0.0/24)

As far as I know, ASA does not send ICMP redirect messages; you can add a static route on the PC for the network 10.1.0.0 to go directly to switch instead of ASA; that will solve the issue for that PC only.

I think the best practice is to create a routing subnet between the switch and ASA:

PC - SWITCH in VLAN1

SWITCH - ASA in a new VLAN used for routing

that means you have to make the switch your default gateway for VLAN1 and change the IP of the inside interface of the ASA + change the routes...

check this link to understand ICMP redirects:

http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html

other forum posts discuss the same issue:

https://supportforums.cisco.com/discussion/11229301/icmp-redirect

Patrick

Community Member

 Hi Patrick,when i assigned

 

Hi Patrick,

when i assigned static route to PC as you said then ping worked fine.

If you can explain me how traffic flows from PC  to Switch ?

Learned something new today.Will read about ICMP redirects and will have better understanding then.

Best Regards

MAhesh

The reason patricks

The reason patricks suggestion worked is because the switch is also doing routing. So in this case the ping never goes through the firewall but instead directly between the pc and switch. -- Please remember to select a correct answer and rate
--

Please remember to rate and select a correct answer
Community Member

 Hi Everyone, Thanks to

 

Hi Everyone,

 

Thanks to everyone for replying on this post.

Best Regards

MAhesh

OK, I just set this up in

OK, I just set this up in GNS3 and got it to work...however I was using a router instead of a PC to ping from.

But I assume that since you can ping your PC from the switch the PC's local firewall isn't blocking ICMP packets.

Have you done a debug on the ICMP packets on the switch to see if there might be something there that is blocking it?

Do you perhaps have an ACL on the ASA inside interface...or on the switch for that matter...that could be blocking the ICMP traffic?

but to answer your questions:

So ASA is sending packet in outside direction instead of inside right?

No, the packet goes from the PC to the ASA, from the ASA to the switch, then from the switch directly back to the PC.

--

Please remember to select a correct answer and rate

--

Please remember to rate and select a correct answer
Community Member

 Hi MAricus,I enabled debug

 

Hi MAricus,

I enabled debug ip icmp on switch and did the ping.

No output was seen on switch.

There is no ACL on switch.

 

Regards

Mahesh

HiIs there an ACL on the ASA

Hi

Is there an ACL on the ASA inside interface that?

could you please provide the ASA and switch configs (sanitised)?

--

Please remember to select a correct answer and rate
 

--

Please remember to rate and select a correct answer
1131
Views
0
Helpful
19
Replies
CreatePlease to create content