Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ASA 5505. We could not get the traffic passed from the Outside to the Inside and vice versa. I understand that traffic flow from Inside to Outside is permitted by default.

Very high level network topology

As the diagram describes, these are the summary:

  1. Inside interface of ASA is configured with
  2. Outside interface of ASA is configured with
  3. Outside network has 4 VLANS, VLAN10 being the VLAN our workstation is sitting at, which carries IP of
  4. There is a server in client's network, which has the IP of
  5. Basically ASA 5506-X is acting as an router to route traffic between Inside and Outside network.
  6. There is a layer 3 switch in the outside network. Which has the static route to reach via the gateway of

ASA 5506-X configuration:

  1. Enabled allow traffic between same interfaces with security level.
  2. ACL permitting ANY ANY ICMP TCP on both Inside and Outside interface.
  3. NAT from outside network to inside network. (its a long list)
  4. Static route to via's device IP) to WAN
  5. Static route to network, via the gateway of (VLAN interface IP in inside network layer 3 switch)

What's is working:

  1. Within the outside network, we have a layer 3 Ruggedcom switch. Where we configured inter-VLAN routing in it and it works fine. All 4 VLANs in outside network are able to communicate, and able to ping to
  2. For client's network switch, its just a layer 2 switch and no VLAN segregation.
  3. All end devices can communicate within their own network.
  4. ASA 5506-X can ping to all equipment and all end devices.

What's is not working:

  1. Outside network end devices is unable to ping inside network end devices even with the static route is established.

I did some research and found out that ASA 5506-X does not allow communication between the interfaces? I even specified ACL to allow ANY traffic from source ANY to destination ANY. I am using ASA version 9.6. What could be going wrong here?

  • Would this question be better posed to Cisco support team? While you'll find people on SSE who might know specific products, it is probably still a good idea to go to the source.
    – Sas3
    Aug 16, 2017 at 2:41
  • 1
    I've flagged this as I don't deem it to be security related. Whilst ACLs are in-fact a "security" function and ASAs are a security appliance the question you're actually asking is not security related, you're asking how to configure routing which is a question better suited to Network Engineering Exchange.
    – user173641
    May 24, 2018 at 17:31
  • "Outside network end devices is unable to ping inside network end devices even with the static route is established." This is normal to be so. What are you actually trying to accomplish ?
    – Overmind
    May 29, 2018 at 11:12

1 Answer 1


Disclaimer: without you posting your config in here it's quite hard for me to help, however, I will attempt to give you an idea of why this might not be working.

Firstly, as you've stated by design you cannot ping an interface if you come from another interface on the same device, this is a security feature of the ASA and it is fully intended to be like this. This is whats known as a "Distant interface". If you think about it, it is a good thing you cannot ping between interfaces, realistically you wouldn't want such a thing even if you think you do. I would like to add this can not be disabled.

Secondly, without altering your access rules you will not be able to achieve this, there is a simple reason for that. The ASA has something called the Modular Policy Framework this is what is essentially stopping this operation from taking place. By default, the MPF will not inspect ICMP traffic. In essence what this means is you will not be able to ping or traceroute from the inside to the outside. There are two ways you can achieve this:

  • Inspecting ICMP
  • Access rule to allow ping replies

By inspecting ICMP traffic this would subsequently allow this function. Alternatively, you can add an access rule to allow the ping replies back in. Ideally, you would want to choose the first one as it is more secure. If you're not inspecting ICMP traffic it is within the realms of possibility for someone to issue an ICMP DoS attack otherwise known as a "Ping flood"

For inspecting ICMP traffic the following is an example of how you would achieve this:

SecSe# config t
SecSe(config)# policy-map global_policy
SecSe(config-pmap)#  class inspection_default
SecSe(config-pmap-c)# inspect icmp

In regards to the second option, a simple access-rule would be sufficient although as I've mentioned this is an ill-advised method:

SecSe# config t
SecSe(config)# access-list OUTSIDE_IN permit icmp any any echo-reply
SecSe(config)# access-group OUTSIDE_IN in interface outside

Thirdly, in regards to your final point, you may have a static route in but it will never work if you don't allow the traffic back in. The problem here is you will need an access rule to allow that traffic into the ASA otherwise it will implicitly drop it as that's how a firewall works.

As I said, for me to help further I will need your configuration but as I've mentioned this is a question which would be better suited on Network Engineering Exchange rather than here.

Not the answer you're looking for? Browse other questions tagged .