ASAicmp检测和内网NAT转化

 拓扑结构 ：

创新互联的团队成员不追求数量、追求质量。我们经验丰富并且专业，我们之间合作时就好像一个人，协同一致毫无保留。创新互联建站珍视想法，同时也看重过程转化带来的冲击力和影响力，在我们眼中，任何细节都不容小觑。一直致力于为企业提供从申请域名、网站策划、网站设计、成都商城网站开发、网站推广、网站优化到为企业提供个性化软件开发等基于互联网的全面整合营销服务。

 摘自 ASA840 配置手册 讲的是inspection引擎对于一些特定协议流量的检测机制 

ACL返回流量规则：  

For TCP and UDP connections for both routed and transparent mode, you do not need an access rule to allow returning traffic because the ASA allows all returning traffic for established, bidirectionalconnections. For connectionless protocols such as ICMP, however, the ASA establishes unidirectionalsessions,

For connectionless protocols such as ICMP, however, the ASA establishes unidirectional sessions, so you either need access rules to allow ICMP in both directions (by applying access lists to the source and destination interfaces), or you need to enable the ICMP inspection engine.The ICMP inspection enginetreats ICMP sessions as bidirectional connections. To control ping, specifyecho-reply(0) (ASA to host)orecho(8) (host to ASA).

思科官方文档解释还是蛮给力的  需要我们好好膜拜！