topic Hi, in Network Security

Passing traffic across interfaces with same security levels.

ddevecka — Tue, 12 Mar 2019 06:44:03 GMT

I am trying to pass traffic across 2 interfaces with the same security levels and I can't seem to get it to work past the Firewall its self. I can ping across the firewall to the other network, but I can't get this to function from a network PC. I am running and ASA 5505, and I have enter the same-security commands as well.

Any help would be appreciated.

Hi,

Akshay Rastogi — Mon, 12 Oct 2015 20:03:30 GMT

Hi,

From the configuration it looks like 'nat-control's is enabled and it is dropping as there is no nat for the traffic.

I could see that you have configured nat-exemption for inside network. Please use the below command :

access-list inside_nat0_outbound line 1 extended permit ip 192.168.153.0 255.255.255.0 192.168.169.0 255.255.0.0

It should work.

Rate if it helps!

Regards,

Akshay Rastogi

Tried that and it didn't work

ddevecka — Wed, 14 Oct 2015 19:05:03 GMT

Tried that and it didn't work.

Hi,Please provide the output

Akshay Rastogi — Wed, 14 Oct 2015 19:48:51 GMT

Hi,

Please provide the output of :

packet-tracer input inside tcp 192.168.153.x 12345 192.168.169.x 12345 det

packet-tracer input inside1 tcp 192.168.169.x 23343 192.168.153.x 22212 det

Regards,

Akshay Rastogi

Hi,Could you also provide the

ealiev — Thu, 15 Oct 2015 12:43:17 GMT

Hi,

Could you also provide the output from these commands:

cap cap_probe type asp-drop all

cap cap_inside match ip host 192.168.153.x host 192.168.169.x

cap cap_inside1 match ip host 192.168.169.x host 192.168.153.x

And try to enable icmp inspection

policy-map global_policy
class inspection_default
inspect icmp

Regards,

Ergin

Here are the results.

ddevecka — Thu, 15 Oct 2015 19:33:54 GMT

Here are the results.

Hi,Are these packet-tracer

Akshay Rastogi — Thu, 15 Oct 2015 20:00:33 GMT

Hi,

Are these packet-tracer output taken after the access-list i asked to add?

Also, i could see that you ran packet-tracer for destination 192.168.168.x. I believe your concerned traffic was '192.168.169.x' ?

It says it is dropped at Access-list level. For testing purpose please add 'permit ip any any' on both the interfaces (153 and 169)

Regards,

Akshay Rastogi

Yes they are. I re-ran them

ddevecka — Thu, 15 Oct 2015 20:24:51 GMT

Yes they are. I re-ran them just to be safe.