topic ASA packet flow in Network Security

ASA packet flow

sistemas.sede — Mon, 11 Mar 2019 18:22:46 GMT

Hi everybody,

My question is: I have an ASA5505 as default gateway (192.168.60.101/24), and a CME router in the same network (192.168.60.254/24) which has others subnets behind, 192.168.61.0/24 (VoIP) & 10.1.10.0/252 (CUE). All my computers has the ASA as default gateway. My problem is, If I try to reach from any computer to the 192.168.61.0/24 network, the ASA does not allow giving an error like this:

Example for ICMP:

"Deny inbound icmp src inside:192.168.60.13 dst inside:192.168.61.1 (type 8, code 0)"

From the firewall rules, I give access from any inbound to inbound traffic, but does not work. I know the packet flow is peculiar because it goes out from the same interface that it came (inside), but it might be possible, isn't' it?

Thanks a lot,

Antonio.

Re: ASA packet flow

August Ritchie — Mon, 09 Aug 2010 17:58:24 GMT

Hello,

This problem is due to the fact that you need to hairpin the traffic back through the inside interface. The ASA doesn't allow u-turning traffic by default, but this document should show you how.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

Re: ASA packet flow

August Ritchie — Mon, 09 Aug 2010 18:02:28 GMT

As a note you will want to change you static (inside,inside) to read something like this.

static (inside,inside) 192.168.61.0 192.168.61.0 netmask 255.255.255.255

Then the rest would be the same

same-security-traffic permit intra-interface

global (inside) 1 interface

Re: ASA packet flow

Kureli Sankar — Mon, 09 Aug 2010 19:26:12 GMT

Antonio,

Pls. let the router do the routing.

Make sure all your inside computers have the CME(192.168.60.254) as the gateway. The CME router should have its default gateway pointing to the ASA.

-KS

Re: ASA packet flow

sistemas.sede — Tue, 10 Aug 2010 07:28:10 GMT

Thank you for your quick answers, I will try the differents solutions.

Regards.