topic Re: how to allow all traffic from outside to inside on ASA 9.8(1) in Network Security

how to allow all traffic from outside to inside on ASA 9.8(1)

hiprecy123 — Fri, 04 Oct 2019 11:46:01 GMT

hello everyone i want to allow all the trafiic coming from the subnet(192.168.10.0/24) connected to outside interface going to the subnet(10.30.30.0/24) connected to ninside interface

please help me i tried all the ways but still havent yet got the solution

currently am running ios version 9.8(1) and the trafiic from inside to outside is working ok

awaiting guys

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

bhargavdesai — Fri, 04 Oct 2019 12:18:32 GMT

Normally you should create ACL and apply the ACL on Outside interface in "IN" direction.

access-list OUTSIDE_IN extended permit ip 192.168.10.0 255.255.255.0 10.30.30.0 255.255.255.0
access-group OUTSIDE_IN in interface OUTSIDE

If you are having issue, can you send the packet tracer output so that it will give us more idea about problem.

packet-tracer input OUTSIDE tcp 192.168.10.10 80 10.30.30.10 80 detailed

HTH
### RATE ALL HELPFUL RESPONSES ###

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

Marius Gunnerud — Fri, 04 Oct 2019 12:19:22 GMT

Would help if you told us exactly what you have tried and also provide us with a full running configuration of your ASA.

Do you have any NAT configuration between the two interfaces you want to allow traffic on?

Normally, if this is just between two private IP address spaces, then you would just allow that traffic in an access list on the outside interface.

access-list outside_access_in permit ip 192.168.10.0 255.255.255.0 10.30.30.0 255.255.255.0

access-group outside_access_in in interface outside

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

hiprecy123 — Fri, 04 Oct 2019 15:11:19 GMT

yeah those subnets are both private ...but thanks for yr support let me apply that and get back to you

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

hiprecy123 — Mon, 07 Oct 2019 03:17:22 GMT

Guys i tried that but it didnt work does the accesslist or the command allow all the traffic including icmp also ??

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

bhargavdesai — Mon, 07 Oct 2019 04:27:48 GMT

You should have ICMP inspected along with the ACLs. You can do that with below mentioned command.

"Fixup protocol icmp"

If you still having issue. please post the Packet-tracer output for ICMP.

packet-tracer input OUTSIDE icmp 192.168.10.10 8 0 10.30.30.10 detailed

HTH
### RATE ALL HELPFUL RESPONSES ###

Re: how to allow all traffic from outside to inside on ASA 9.8(1)

Marius Gunnerud — Mon, 07 Oct 2019 05:16:36 GMT

To allow the return traffic for ping, you would need to either specifically allow this in the ACL on the outside interface or configure inspection of the ICMP protocol as mentioned by @bhargavdesai .

It would really be helpful to see your full running configuration (remove any public IPs, usernames and passwords) as right now we are just guessing at what might be wrong.