Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I add ICMP to be allowed both on inside / outside interfaces the internet connection dies. Does anyone know why this happens?

I kind of observed that this behavior takes place not just for ICMP.

share|improve this question
2  
Are the ICMP rules resulting in the creation of a new access list? My Cisco is a little rusty but I recall having a similar issue. It was because the rule was the first in a new access list and each access list has a default deny at the end, so when the new access list applied where there had been no access list before... This is especially easy to run into if you're using ASDM. –  hwilbanks Nov 27 '12 at 17:39
add comment

1 Answer

When there are no ACLs on an interface, the relative security-levels of the interfaces involved determine access, i.e. if the ingress interface has security-level 50 and the egress interface has security-level 10, you are always granted access.

Adding ANY access rules to an interface switches the default rule to deny all.

Confusing? You betcha.

share|improve this answer
    
I agree this is probably the answer. to actually be sure, add a rule that allows all traffic trough the interface where your going to enable the ICMP and test it. after that add the proper rules to allow your internet traffic to go trough in a secure manner. –  Flash Dec 11 '12 at 10:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.