Remote connection on inside interface ASA5505

Iske — Mon, 11 Mar 2019 14:04:51 GMT

We're upgrading our network. As a part of the process we're replacing our 1750 Routers with a ASA 5505 with the latest software version 8.0.4.

As far as ACLs, NAT'ing and routing goes so the config is the same on the new box.

The problem is with a remote PC we have on the other end of a point to point SHDSL connection. The connection is VLAN, layer2 based and there are no routers in between, just a modem at each end.

what happens is that traffic is dropped on the inside interface of the ASA box from the remote PC. Traffic from the ASA to the remote PC (ping for example) is fine, also the remote PC can ping other IP addresses at the other end of the DSL line but not the inside IP of the ASA.

It makes no difference if the link from the remote site is connected directly to an ASA port or via another switch.

We've discovered that if we clear the ARP cache of the remote PC we get 1 ping reply before traffic is dropped.

Pinging the remote site from the ASA works though we experience a certain amount of lost packets.

There's something about the ASA and this type of link that's causing this but we don't know what. Our best guess is that it's some kind of security feature ??

Put in a PC with the same inside IP, mac address as the ASA, cable etc. and traffic flows both ways without a problem which is why we think it's down to the ASA.

same-security-traffic permit inter-interface

and

same-security-traffic permit intra-interface

is already enabled.

Any suggestions ? We're stuck.

Thank you.

Uli

Re: Remote connection on inside interface ASA5505

andrew.prince — Wed, 29 Oct 2008 17:54:14 GMT

Check the IP addressing for the local LAN and the remote PC.

Re: Remote connection on inside interface ASA5505

Iske — Sat, 08 Nov 2008 18:06:42 GMT

Looks like we got it, the provider uses a different vlan tag for the shdsl connection but

uses the same ip network 192.168.x.x. So we

have vlan 1 on the inside Network and vlan 101 over the shdsl connection. We're now trying the

Security Plus License and define a trunk on the

inside Interface with vlan 1 and 101. Hope

this will work.

topic Re: Remote connection on inside interface ASA5505 in Network Security

Remote connection on inside interface ASA5505

Re: Remote connection on inside interface ASA5505

Re: Remote connection on inside interface ASA5505