Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently trying to set up a failover network for my Cisco ASA 55x0 using the SLA traking. I have the "outside" interface (network 89.x.x.48/29) and the "outside2" interface (network 192.168.70.0/24).

  track 1 rtr 1 reachability
  sla monitor 1
    type echo protocol ipIcmpEcho 89.x.x.49 interface outside
  sla monitor  schedule 1 start-time now life forever
  route outside 0.0.0.0 0.0.0.0 89.x.x.49 128  track 1

As you can see I set up the ping on IP 89.x.x.49, this one reply when I try to ping from my computer that is in the "inside" network:

$ ping 89.x.x.49

Pinging 89.x.x.49 with 32 bytes of data:
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255
Reply from 89.x.x.49: bytes=32 time=1ms TTL=255

Ping statistics for 89.x.x.49:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

The problem

In the picture there is my problem: seems there is a rule on the Cisco that block all the echo-replies from the ip 89.x.x.49 to the firewall, despite I can reach it using my computer and it can reply to my computer.

UPDATE:

Here the capture on the outside interface, the behavior seems correct, but the Cisco ASA always denies all the echo-replies toward it. packet capture on "outside"

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Found the solution: the icmp packets were denied.

config t
icmp permit 89.x.x 49  255.255.255.255 outside
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.