ASA 允许ping和trace配置

ASA ping和trace配置

外网不能ping和tracer内网，内网可以ping和trace外网：

1.写acl，允许从外口返回的trace流量：

access-list ping extended permit icmp any any time-exceeded access-list ping extended permit icmp any any unreachable access-group ping in interface outside

2.在全局下放行ping：

policy-map global_policy

class inspection_default

inspect icmp

3：设置decrement-ttl，使得ping不显示“*”

policy-map global_policy

class class-default

set connection decrement-ttl

##############################################################

icmp deny any outside outside接口禁止ping