ASA\/PIX Inbound ICMP through the PIX is denied by default;
\noutbound ICMP is permitted, but the incoming reply is denied by default.<\/p>\n
Pings Outbound<\/strong><\/p>\n Responses to outbound ICMP can be permitted with either a conduit statement or an This example shows how to permit responses to ICMP requests initiated by device 10.1.1.5 inside static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 0 0<\/strong><\/p>\n !— and either<\/p>\n conduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 echo-reply !— or<\/p>\n access-list 101 permit icmp any host 192.168.1.5 echo-reply Pings Inbound<\/strong><\/p>\n Pings initiated from the outside, or another low security interface of the PIX, In this example, one server on the inside of the PIX is made accessible to external pings. pix(config)#static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255 \u00a0<\/strong><\/p>\n In this example, the PIX cannot send echo replies in response to echo requests:<\/p>\n As with access lists, in the absence of permit<\/strong> statements, there is also an implicit deny of all other ICMP traffic.<\/p>\n This command permits pings from the network immediately outside the PIX:<\/p>\n As with access lists, in the absence of permit<\/strong> statements, there is also an implicit deny of all other ICMP traffic. ping 172.20.186.1 inside ASA\/PIX Inbound ICMP through the PIX is denied by default; outbound ICMP is permitted, but the incoming reply is denied by default. Pings Outbound Responses to outbound ICMP can be permitted with either a conduit statement or an access-list statement, based on which you use on the PIX. Do not mix conduits and access lists. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[344],"class_list":["post-957","post","type-post","status-publish","format-standard","hentry","category-cisco-routers","tag-icmp"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=957"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/957\/revisions"}],"predecessor-version":[{"id":4821,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/957\/revisions\/4821"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\naccess-list statement, based on which you use on the PIX. Do not mix conduits and access lists.<\/p>\n
\n(static to 192.168.1.5) from all devices outside:<\/p>\n
\nconduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 source-quench
\nconduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 unreachable
\nconduit permit icmp 192.168.1.5 255.255.255.255 0.0.0.0 0.0.0.0 time-exceeded<\/strong><\/p>\n
\naccess-list 101 permit icmp any host 192.168.1.5 source-quench
\naccess-list 101 permit icmp any host 192.168.1.5 unreachable
\naccess-list 101 permit icmp any host 192.168.1.5 time-exceeded
\naccess-group 101 in interface outside<\/strong><\/p>\n
\nare denied be default. The pings can be allowed by the use of static and
\naccess lists or access lists alone.<\/p>\n
\nA static translation is created between the inside address (10.1.1.5) and the outside address (192.168.1.5).<\/p>\n
\npix(config)#access-list 101 permit icmp any host 192.168.1.5 echo
\npix(config)#access-group 101 in interface outside<\/strong><\/p>\n\n
icmp deny any echo outside<\/strong><\/pre>\n<\/blockquote>\n
\n
icmp permit 192.168.1.0 255.255.255.0 echo outside<\/strong><\/pre>\n<\/blockquote>\n
\n!
\n!
\nTo ping the pix inside ip address from the other side of the tunnel,
\nyou will need to enable “management-access inside<\/strong>“.
\n!
\nAs far as pinging from the pix, you would need to create an IPSEC SA that
\ncontains the pix outside ip address since the source of the ICMP packet will
\nbe the outside interface address.
\neq :<\/p>\n
\nping 80.233.56.1 outside<\/p>\n","protected":false},"excerpt":{"rendered":"