topic Cisco ASA 8.4 Inter interface Communication in Network Security

Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Tue, 12 Mar 2019 01:57:01 GMT

Hello, I have two ports I want communication between and I feel like it should work but still even pings fail. Below are the relevant entries from the running config. Any idea what I'm missing? Thanks.

interface GigabitEthernet0

mac-address 020c.f142.4cde

nameif left

security-level 0

ip address 192.168.0.1 255.255.255.0

interface GigabitEthernet1

mac-address 020c.f142.4cdf

nameif right

security-level 0

ip address 192.168.1.1 255.255.255.0

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list 1 extended permit icmp any any

access-list 1 extended permit icmp any any echo-reply

access-list 1 extended permit icmp any any echo

access-list 1 extended permit icmp any any source-quench

access-list 1 extended permit icmp any any unreachable

access-list 1 extended permit icmp any any time-exceeded

access-group 1 in interface left

access-group 1 out interface left

access-group 1 in interface right

access-group 1 out interface right

Cisco ASA 8.4 Inter interface Communication

Leo Laohoo — Wed, 12 Jun 2013 22:14:03 GMT

Duplicate posts.

Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Wed, 12 Jun 2013 22:44:30 GMT

Hello, yeah the (1) one was a mistake and never should've been approved since it was waiting for moderator approval in the first place. Anyways, can you please tell me in this thread what I've overlooked? Thanks.

Cisco ASA 8.4 Inter interface Communication

Julio Carvajal — Wed, 12 Jun 2013 23:18:10 GMT

Hello John,

Okay so you will need to close one discussion,

Now with the configuration u have u should be able to Ping,

My question would be,

Why are u using the same ACL on both interfaces in both directions?

So can you remove the access-groups from both interfaces (both directions)

and just add the following command:

fixup protocol icmp

Also provide the output of

packet-tracer input right icmp 192.168.1.10 8 0 192.168.0.10

Regards

Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Wed, 12 Jun 2013 23:24:22 GMT

Hm yeah I thought I'd be able to ping too. But I ruled out iptables because a machine on one subnet can't even ping the gateway of the other subnet. As for the ACL, I thought that had to be done to allow ICMP traffic to come in and out both sides? Or should it work without the ACLs and just the same-security-traffic clause? Thanks and sorry for the thread confusion.

Cisco ASA 8.4 Inter interface Communication

Julio Carvajal — Wed, 12 Jun 2013 23:28:19 GMT

Hello John,

It should work with the same-security traffic command,

Lets add the command

fixup protocol icmp ( to statefully inspect ICMP packets)

Can u provide the packet-tracer output?

Remember to rate all of the helpful posts

Re: Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Wed, 12 Jun 2013 23:31:54 GMT

Oh ok, yeah I'll get back to you tomorrow morning with the results of your suggestions since I'm not at work at the moment. Thanks. I guess I was worried that perhaps the ASA unit defaulted to highly restrictive ACLs when none were otherwise present, good to know that's not the case.

Re: Cisco ASA 8.4 Inter interface Communication

Julio Carvajal — Wed, 12 Jun 2013 23:39:45 GMT

Hello,

That would be the case if u are going from a lower to a higher security level interface.

In this case we are dealing with same-security level interfaces,

Remember to rate all of the helpful posts

Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Thu, 13 Jun 2013 13:30:03 GMT

Hi, thanks for your help. I'll be sure to rate your posts after the problem is identified of course. So this is the config I have now:

interface GigabitEthernet0

nameif left

security-level 0

ip address 192.168.0.1 255.255.255.0

interface GigabitEthernet1

nameif right

security-level 0

ip address 192.168.1.1 255.255.255.0

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

and the results of the tracer command:

ciscoasa(config)# packet-tracer input right icmp 192.168.1.10 8 0 192.168.0.10

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 192.168.0.0 255.255.255.0 left

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

Additional Information:

Phase: 5

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 7

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 6, packet dispatched to next module

Result:

input-interface: right

input-status: up

input-line-status: up

output-interface: left

output-status: up

output-line-status: up

Action: allow

Yet the machines on each side can still only ping their own gateways, any idea??

Cisco ASA 8.4 Inter interface Communication

Jouni Forss — Thu, 13 Jun 2013 14:39:13 GMT

Hi,

Are you sure that there is nothing blocking the ICMP messages on the actual hosts?

Are you sure that the hosts dont have any additional network connection on which holds the default route and forwards traffic incorrectly?

Are you sure that the default gateway and network masks are configured correctly on the hosts sending ICMP Echo?

- Jouni

Cisco ASA 8.4 Inter interface Communication

Julio Carvajal — Thu, 13 Jun 2013 16:53:23 GMT

Hello John,

As U can see from the packet-tracer the result is:

input-interface: right

input-status: up

input-line-status: up

output-interface: left

output-status: up

output-line-status: up

Action: allow

So that being said, my recomendation would be:

-Make sure the IP/Subnet mask and default gateway are properly set on both PCs

-Make sure that you do not have windows firewall on blocking ICMP packets.

Quick question:

Can you ping from the ASA to both PCs?

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

Cisco ASA 8.4 Inter interface Communication

jmusbach2 — Thu, 13 Jun 2013 21:33:48 GMT

Hi thanks, turns out it was a misconfiguration of the virtualbox VMs in the virtual LAN. Once that was sorted it worked fine.

Cisco ASA 8.4 Inter interface Communication

Julio Carvajal — Fri, 14 Jun 2013 03:23:24 GMT

Great to see that John,

Regards,

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.