1

The network is as follows:

Two Default Gateways exist on the network - one which provides connectivity to the an MPLS with several subnets. Let's say 10.0.0.2

Another which is a Cisco Firewall, on 10.0.0.1, with a WAN Connection. A server exists on the LAN with it's DG as the above Cisco Firewall. On the firewall there is a route that tells says anything destined to one of the MPLS subnets (192.168.99.0/24) to go to the MPLS router (on it's LAN IP).

On the INSIDE interface, there is any Any, Any, IP allow rule (all traffic).

However, I cannot ping anything on the MPLS and the logs on the Cisco show the "Implicit" Any,Any Deny is dropping the ping traffic. It's the same for everything - HTTPs, HTTP etc.

What's missing?

1
  • 1
    Could you please clarify your network a little and also explain the data flow of the server connectivity.
    – onxx
    Apr 6, 2015 at 23:22

4 Answers 4

1

I think the security-level should be considered. You can ping from Inside to Outside, but the echo traffic must be allowed to go back to Inside.

1

Assuming you've checked the basics like ensuring that the access list is actually bound to the interface with the access-group command, if the logs are showing that the traffic is being denied, you can find out more information by simulating a packet with the packet-tracer command. That should tell you exactly why the packet is being rejected.

Assuming your inside server is 10.0.0.10 and a host on the MPLS network is 192.168.99.10, and your inside interface is called inside then the command would be this:

packet-tracer input inside icmp 10.0.0.10 8 0 192.168.99.10 detailed
0

I assume that you need rules for the ICMP (not IP) traffic to allow ping.

First of all, you question could be duplicated to this one: How do you allow ICMP Echo Requests on a Cisco ASA 55xx Router?

However, I use slightly another configuration to allow ping. From your question, I'm not sure on which interface you need to allow it, so I'll just post my configuration as example, please fix it according to your setup:

access-list allow_ping_outside extended permit icmp any interface outside 
access-list outside_access_in extended permit icmp any interface outside 
access-list allow_ping extended permit icmp any any

icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any unreachable outside
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit any time-exceeded outside

Documentation (just google for your version of ASA, e.g. 8.2 or 8.4, there are a lot of official documentation available):

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/i1.html#wp1697623

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_management.html#wp1267985

EDIT: concerning other traffic, it is very hard to guess and I hoped that you could provide more details in your question. I assume that you have 2 active LAN interfaces (with the same security level) and 1 WAN. Then, to allow communication for hosts in different LANs (with the same sec. level), you need to explicitly allow it:

same-security-traffic permit inter-interface

See also: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s1.html#wp1421315

If you really use 3 interfaces, please also consider limitations of your license (see number of VLANs):

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/intro_license.html#55668

-2

You can use the 'deny all log' command in the ACL to see the realtime results of the 'implicit' deny all rule and go from there. It was called the 'explicit' deny all rule.. googling

here it is

edit: sounds like you may have already done this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .