cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
473
Views
0
Helpful
1
Replies

ICMP on ASA5510

Ali Norouzi
Level 1
Level 1

I want to allow ICMP traffic on ASA 5510 from LAN interface to DMZ. I've permit any traffic and added ICMP to the inspestion list also but still there is problem. Belos is the configuration. The image is asa822-k8.bin

:

ASA Version 8.2(2)

!

hostname fw-01

names

!

interface Ethernet0/0

nameif LAN

security-level 50

ip address 172.20.4.2 255.255.255.252

!

interface Ethernet0/1

nameif DMZ

security-level 100

ip address 172.20.4.65 255.255.255.252

!

interface Ethernet0/2

no nameif

no security-level

no ip address

!

interface Ethernet0/3

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 172.20.1.220 255.255.255.0

management-only

!

boot system disk0:/asa822-k8.bin

ftp mode passive

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list DMZ-->LAN extended permit ip any any

access-list DMZ-->LAN extended permit icmp any any

access-list LAN-->DMZ extended permit ip any any

access-list LAN-->DMZ extended permit icmp any any

pager lines 24

logging enable

logging asdm informational

mtu LAN 1500

mtu DMZ1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

access-group LAN-->DMZ in interface LAN

access-group DMZ-->LAN out interface LAN

access-group DMZ-->LAN in interface DMZ

access-group LAN-->DMZ out interface DMZ

route LAN 10.0.0.0 255.0.0.0 172.20.4.1 1

route DMZ 172.30.0.0 255.255.255.0 172.20.4.66 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication telnet console LOCAL

http server enable

http 10.0.0.5 255.255.255.255 LAN

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet 0.0.0.0 0.0.0.0 LAN

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username cisco password 3USUcOPFUiMCO4Jk encrypted

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

!

service-policy global_policy global

prompt hostname context

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:0055841bfefc4136bb22c6cd5b425b9b

: end

1 Reply 1

cadet alain
VIP Alumni
VIP Alumni

Hi,

verify the device on DMZ you're pinging has a route back to LAN subnet.

Regards.

Alain.

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: