#CANNOT PING ASA THROUGH EASYVPN HOW TO#

The by far most likely scenarios are Comcast blocking something, or a bug in the firmware (and I do not shout 'bug' easily - but permitting ping and ssh to an ASA that otherwise can be pinged and ssh'd into from other interfaces is about as easy as configuration gets). You have the appropriate 'http', 'ssh', and 'icmp' commands in your config. That's management/control plane traffic, for which you don't need any ACLs or inspection rules. Your config contains a bunch of unnecessary things, presumably from trying different things attempting to resolve this issue - but you should be able to ping that ASA outside interface from anywhere other than its inside network, and you should be able to SSH or use ASDM against it from 6.6.6.6.

Does the packet show up in that capture? If yes, what is the reason? What about the reply? Cisco ASA Unable to ping interface when using IPv6 Issue When configuring IPv6. Site B has a PIX in front of it and a switch. Site A is directly connected to the Internet with no devices in front of it. Does the capture contain the packet? Does it contain a reply?ĭo a packet capture of type 'asp drop all' (or a stricter subtype if you know what category you're interested for) to show all packets dropped by the ASA for any reason. We are using Easy VPN to establish a VPN connection back to our office. I have two ASA 5505s set up site to site. Is the traffic allowed?ĭo a packet capture on the interfaces traversed by the traffic (in this case, just 'outside'). Three generic steps to troubleshooting ASAs: There was a firewall on the damn modem! Arg comcast! Thank you everyone for your troubleshooting assistance! Now to clean up the million entries I've made over time on the ASA while troubleshooting.

#CANNOT PING ASA THROUGH EASYVPN HOW TO#

What is going on here? I know I borked the config but I can't for the life of me figure out how to fix it.Īny assistance would be greatly appreciated.Įdit: i got a laptop hooked up to the comcast modem with 1.2.3.5 and I cannot access it via ping and such, so I'm guessing its either the gateway or comcast modem that is blocking stuff. Click on Configuration at the top and then select Remote Access VPN Click on Certificate Management and then click on Identity Certificates Click Add and then Add a new identity certificate. Even though I added https/ssh access for 6.6.6.6 it cannot hit the asa either.Īnother weird quirk, is there is no communication over the tunnel that is setup with the remote site unless I add an access-list entry to permit all on the outside interface (outside_access_in). Something weird is definitely going on with this config. I call upon the r/networking gods for assistance! I'm smashing my head against the wall and I have a feeling know im missing something.įor some reason I can not ping the outside interface of the device (1.2.3.4) from an external site.

Cannot ping asa through easyvpn