I need to connect two internal LANs each of which has ASA as a firewall to outside. One has ASA 5505 with two interfaces and another - ASA 5510 with three interfaces. I managed to pass echo packets from one internal LAN to another, but not the TCP packets. It must be something simple that I missed. Any help will be highly appreciated! Here is the network diagram:
Here is Config from ASA 5510 (i removed obvious settings to save space):
interface Ethernet0/0 nameif outside security-level 0 ip address YY.YY.YY.YY 255.255.255.224 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.35.1 255.255.255.0 ! interface Ethernet0/2 nameif a-02 security-level 100 ip address 192.168.30.250 255.255.255.0 ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns server-group DefaultDNS domain-name latista.local same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list outside_access_in extended permit icmp any any inactive access-list a-02_access_in extended permit ip any any access-list a-02_access_in extended permit icmp any any inactive access-list inside_access_in extended permit ip any any access-list inside_access_in extended permit icmp any any inactive access-list inside_access_out extended permit ip any any access-list inside_access_out extended permit icmp any any inactive access-list inside_nat0_outbound_1 extended permit ip 192.168.35.0 255.255.255.0 192.168.30.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.35.0 255.255.255.0 192.168.30.0 255.255.255.0 access-list a-02_nat0_outbound extended permit ip 192.168.30.0 255.255.255.0 192.168.35.0 255.255.255.0 access-list a-02_nat0_outbound_1 extended permit ip 192.168.30.0 255.255.255.0 192.168.35.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 mtu a-02 1500 mtu management 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 nat (inside) 0 access-list inside_nat0_outbound nat (inside) 0 access-list inside_nat0_outbound_1 outside nat (a-02) 0 access-list a-02_nat0_outbound nat (a-02) 0 access-list a-02_nat0_outbound_1 outside access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group inside_access_out out interface inside access-group a-02_access_in in interface a-02 ! router rip version 1 ! route outside 0.0.0.0 0.0.0.0 205.251.79.33 1 route inside 192.168.30.0 255.255.255.0 192.168.30.250 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy http server enable http 192.168.1.0 255.255.255.0 management http 192.168.35.0 255.255.255.0 inside http 67.208.89.64 255.255.255.224 outside http 4.26.115.0 255.255.255.240 outside http 192.168.30.0 255.255.255.0 a-02 http 192.168.20.0 255.255.255.0 a-02 http 96.255.26.199 255.255.255.255 outside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh timeout 5 console timeout 0 ! threat-detection basic-threat threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 webvpn ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect http ! service-policy global_policy global
On another ASA (ASA 5505) I only configured the Routing and NAT Exemption. Here is that portion:
same-security-traffic permit intra-interface
access-list inside_nat0_outbound extended permit ip NET_COLO_INT 255.255.255.0 192.168.35.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.35.0 255.255.255.0 NET_COLO_INT 255.255.255.0
route inside 192.168.35.0 255.255.255.0 192.168.30.250 1
Please help!
1 Accepted Solution
Accepted Solutions
