Cisco asa

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

What is the basic thing you have to do to get a device on one side of an ASA to ping a device on another?

The devices on the networks either side of the ASA can ping it fine (well actually the high side can, and the low side can't...but the ASA can see the device on the low side)

I have set up NAT to change each device so that they are converted to the correct IP when they get from one side to the other.

In access rules, it's confusing. Once you've used NAT, which ip addresses are you supposed to be allowing to communicate with the other side? The original ip, or the one that occurs after NAT?

Is it just ICMP echo and ICMP echo reply that should be enabled, or do you need to add another service also?

Is there some other kind of access control that needs to be configured?

Please somebody help

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Something like this should work

access-list <ACL_NAME> extended permit icmp any host <HOST> echo
access-list <ACL_NAME> extended permit icmp any host <HOST> echo-reply

 

This is from a PIX but should be similar:

access-list outside permit icmp any any echo
access-list outside permit icmp any any echo-reply
access-list outside permit icmp any any source-quench
access-list outside permit icmp any any unreachable
access-list outside permit icmp any any time-exceeded

If the link is across a VPN for example you need to create a No Nat Rule and apply this as well e.g.

access-list no_nat permit ip 10.10.194.0 255.255.255.0 192.168.145.0 255.255.255.0
nat (inside) 0 access-list no_nat
nat (inside) 1 10.10.194.0 255.255.255.0 0 0

 

Thank you!