Cisco ASA not routing between interfaces The Next CEO of Stack OverflowCisco - NAT causes nslookup to return local IPProblem routing between directly connected Subnets w/ ASA-5510How to disable dns doctoring for IPSEC VPN connections for ASA 5510How to NAT a 192.168.x.x corporate domain on a Cisco ASA to not conlict with VPN remote users LANsCisco ASA - Enable communication between same security levelSimple Cisco ASA 5505 config issueNAT translation with Cisco ASA 5505NTP client on CentOS 5 fails behind Cisco ASA firewallAllow Ports 80, 443 and 81 through ASA 5510Cisco ASA 5505 RDP
Graph of the history of databases
Could a dragon use its wings to swim?
Where do students learn to solve polynomial equations these days?
What is the difference between "hamstring tendon" and "common hamstring tendon"?
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Can Sneak Attack be used when hitting with an improvised weapon?
Easy to read palindrome checker
Is fine stranded wire ok for main supply line?
What was Carter Burke's job for "the company" in Aliens?
Do I need to write [sic] when including a quotation with a number less than 10 that isn't written out?
Are the names of these months realistic?
Computationally populating tables with probability data
how one can write a nice vector parser, something that does pgfvecparseA=B-C; D=E x F;
vector calculus integration identity problem
Why is the US ranked as #45 in Press Freedom ratings, despite its extremely permissive free speech laws?
How to Implement Deterministic Encryption Safely in .NET
Is it correct to say moon starry nights?
How do I fit a non linear curve?
Purpose of level-shifter with same in and out voltages
Reference request: Grassmannian and Plucker coordinates in type B, C, D
How did Beeri the Hittite come up with naming his daughter Yehudit?
Would a grinding machine be a simple and workable propulsion system for an interplanetary spacecraft?
What day is it again?
Is it OK to decorate a log book cover?
Cisco ASA not routing between interfaces
The Next CEO of Stack OverflowCisco - NAT causes nslookup to return local IPProblem routing between directly connected Subnets w/ ASA-5510How to disable dns doctoring for IPSEC VPN connections for ASA 5510How to NAT a 192.168.x.x corporate domain on a Cisco ASA to not conlict with VPN remote users LANsCisco ASA - Enable communication between same security levelSimple Cisco ASA 5505 config issueNAT translation with Cisco ASA 5505NTP client on CentOS 5 fails behind Cisco ASA firewallAllow Ports 80, 443 and 81 through ASA 5510Cisco ASA 5505 RDP
I am hoping someone can help me with an issue I am seeing on a Cisco ASA device, I am having an issue getting an outside interface to pass traffic to a public interface.
Outside = 65.125.x.x
Public = 65.121.x.x
When I ping the public IP the packet is received on the outside interface (that is where the subnet is routed) but is never forwarded to the public interface (confirmed by a packet capture).
Both interfaces have the same security level of zero and I have the following command configured.
same-security-traffic permit inter-interface
I also have the following rules on each interface..
access-list outside_public extended permit icmp any any
access-list outside_public extended permit ip any any
I also set up a NAT rule for the traffic.
nat (public,outside) source static 65.121.x.x_27 65.121.x.x_27 destination static 65.125.x.x_29 65.125.x.x_29
nat (outside,public) source static 65.125.x.x_29 65.125.x.x_29 destination static 65.121.x.x_27 65.121.x.x_27
When i ping 65.121.x.x I see the packets on the outside interface but nothing on the public interface, I am quite stumped on this.
Any help would be hugely appreciated as I am going around the bend with this one. I know this would work with a router but I cant seem to make the ASA reachable on the second interface with the additional public subnet attached.
networking security cisco cisco-asa
edited Dec 19 '16 at 20:23
hertitu
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I am hoping someone can help me with an issue I am seeing on a Cisco ASA device, I am having an issue getting an outside interface to pass traffic to a public interface.
Outside = 65.125.x.x
Public = 65.121.x.x
When I ping the public IP the packet is received on the outside interface (that is where the subnet is routed) but is never forwarded to the public interface (confirmed by a packet capture).
Both interfaces have the same security level of zero and I have the following command configured.
same-security-traffic permit inter-interface
I also have the following rules on each interface..
access-list outside_public extended permit icmp any any
access-list outside_public extended permit ip any any
I also set up a NAT rule for the traffic.
nat (public,outside) source static 65.121.x.x_27 65.121.x.x_27 destination static 65.125.x.x_29 65.125.x.x_29
nat (outside,public) source static 65.125.x.x_29 65.125.x.x_29 destination static 65.121.x.x_27 65.121.x.x_27
When i ping 65.121.x.x I see the packets on the outside interface but nothing on the public interface, I am quite stumped on this.
Any help would be hugely appreciated as I am going around the bend with this one. I know this would work with a router but I cant seem to make the ASA reachable on the second interface with the additional public subnet attached.
networking security cisco cisco-asa
edited Dec 19 '16 at 20:23
hertitu
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
1
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this onepacket-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x?
– Peter Zhabin
Dec 19 '16 at 16:21
add a comment |
I am hoping someone can help me with an issue I am seeing on a Cisco ASA device, I am having an issue getting an outside interface to pass traffic to a public interface.
Outside = 65.125.x.x
Public = 65.121.x.x
When I ping the public IP the packet is received on the outside interface (that is where the subnet is routed) but is never forwarded to the public interface (confirmed by a packet capture).
Both interfaces have the same security level of zero and I have the following command configured.
same-security-traffic permit inter-interface
I also have the following rules on each interface..
access-list outside_public extended permit icmp any any
access-list outside_public extended permit ip any any
I also set up a NAT rule for the traffic.
nat (public,outside) source static 65.121.x.x_27 65.121.x.x_27 destination static 65.125.x.x_29 65.125.x.x_29
nat (outside,public) source static 65.125.x.x_29 65.125.x.x_29 destination static 65.121.x.x_27 65.121.x.x_27
When i ping 65.121.x.x I see the packets on the outside interface but nothing on the public interface, I am quite stumped on this.
Any help would be hugely appreciated as I am going around the bend with this one. I know this would work with a router but I cant seem to make the ASA reachable on the second interface with the additional public subnet attached.
networking security cisco cisco-asa
edited Dec 19 '16 at 20:23
hertitu
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
I am hoping someone can help me with an issue I am seeing on a Cisco ASA device, I am having an issue getting an outside interface to pass traffic to a public interface.
Outside = 65.125.x.x
Public = 65.121.x.x
When I ping the public IP the packet is received on the outside interface (that is where the subnet is routed) but is never forwarded to the public interface (confirmed by a packet capture).
Both interfaces have the same security level of zero and I have the following command configured.
same-security-traffic permit inter-interface
I also have the following rules on each interface..
access-list outside_public extended permit icmp any any
access-list outside_public extended permit ip any any
I also set up a NAT rule for the traffic.
nat (public,outside) source static 65.121.x.x_27 65.121.x.x_27 destination static 65.125.x.x_29 65.125.x.x_29
nat (outside,public) source static 65.125.x.x_29 65.125.x.x_29 destination static 65.121.x.x_27 65.121.x.x_27
When i ping 65.121.x.x I see the packets on the outside interface but nothing on the public interface, I am quite stumped on this.
Any help would be hugely appreciated as I am going around the bend with this one. I know this would work with a router but I cant seem to make the ASA reachable on the second interface with the additional public subnet attached.
networking security cisco cisco-asa
networking security cisco cisco-asa
edited Dec 19 '16 at 20:23
hertitu
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
edited Dec 19 '16 at 20:23
hertitu
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
edited Dec 19 '16 at 20:23
hertitu
30716
edited Dec 19 '16 at 20:23
hertitu
30716
edited Dec 19 '16 at 20:23
hertitu
30716
30716
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
asked Dec 19 '16 at 15:41
Leoric80Leoric80
294
294
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ yesterday
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
1
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this onepacket-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x?
– Peter Zhabin
Dec 19 '16 at 16:21
add a comment |
1
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this onepacket-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x?
– Peter Zhabin
Dec 19 '16 at 16:21
1
1
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this one
packet-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x ?– Peter Zhabin
Dec 19 '16 at 16:21
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this one
packet-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x ?– Peter Zhabin
Dec 19 '16 at 16:21
add a comment |
1 Answer
1
active
oldest
votes
Couple quick items to check with Cisco ASA firewalls and ping. You may need to set a "Management access interface". I have had this cause problems with ping before.
You may also need to put some other policies in place to allow ping. Firewall rules will not always allow it. There are other policies that can pull out the traffic at the inspection layer. The simple way for new spin-ups is:
Fixup protocol ICMP
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
add a comment |
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f821608%2fcisco-asa-not-routing-between-interfaces%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Couple quick items to check with Cisco ASA firewalls and ping. You may need to set a "Management access interface". I have had this cause problems with ping before.
You may also need to put some other policies in place to allow ping. Firewall rules will not always allow it. There are other policies that can pull out the traffic at the inspection layer. The simple way for new spin-ups is:
Fixup protocol ICMP
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
add a comment |
Couple quick items to check with Cisco ASA firewalls and ping. You may need to set a "Management access interface". I have had this cause problems with ping before.
You may also need to put some other policies in place to allow ping. Firewall rules will not always allow it. There are other policies that can pull out the traffic at the inspection layer. The simple way for new spin-ups is:
Fixup protocol ICMP
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
add a comment |
Couple quick items to check with Cisco ASA firewalls and ping. You may need to set a "Management access interface". I have had this cause problems with ping before.
You may also need to put some other policies in place to allow ping. Firewall rules will not always allow it. There are other policies that can pull out the traffic at the inspection layer. The simple way for new spin-ups is:
Fixup protocol ICMP
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
Couple quick items to check with Cisco ASA firewalls and ping. You may need to set a "Management access interface". I have had this cause problems with ping before.
You may also need to put some other policies in place to allow ping. Firewall rules will not always allow it. There are other policies that can pull out the traffic at the inspection layer. The simple way for new spin-ups is:
Fixup protocol ICMP
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
answered Dec 19 '16 at 21:08
Cory KnutsonCory Knutson
1,711719
1,711719
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f821608%2fcisco-asa-not-routing-between-interfaces%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
It's hard to tell whats going on without full ASA configuration file. Have you tried running a packet-tracer command similar to this one
packet-tracer input outside icmp 8.8.8.8 1 1 65.121.x.x?– Peter Zhabin
Dec 19 '16 at 16:21