I have tried many troubleshooting steps I've seen in this forum, hoping someone has an idea.
I have a Cisco ASA 5505 running 8.2(5), with a Base license. I have a lab setup, and I'm basically trying to get it to pass packets from inside to outside. I don't need NAT, but I have it on at the moment as a test, since most of the example configs I see are using NAT. I have tried with and without ACLs, with and without NAT, have verified packets are hitting the interface, have tried tracing. Let me throw some examples at you:
cisco-asa-5505# show run
: Saved
:
ASA Version 8.2(5)
!
terminal width 511
hostname cisco-asa-5505
enable password xxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxx encrypted
names
!
interface Ethernet0/0
description to Catalyst FastEthernet 0/18 (10.18.2.x/24 untagged)
switchport access vlan 182
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
description to Catalyst FastEthernet 0/34 (10.19.2.x/24 untagged)
switchport access vlan 192
!
interface Vlan182
description 10.18.2.x/24
nameif inside
security-level 100
ip address 10.18.2.2 255.255.255.0
!
interface Vlan192
description 10.19.2.x/24
nameif outside
security-level 0
ip address 10.19.2.2 255.255.255.0
!
no ftp mode passive
pager lines 24
logging enable
logging timestamp
logging buffer-size 1048576
logging trap notifications
logging history critical
logging device-id hostname
logging host inside 10.16.0.100 6/1470
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
global (outside) 1 10.19.2.3
nat (inside) 1 10.17.2.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 10.19.2.1 1
route inside 10.8.0.0 255.255.0.0 10.18.2.1 1
route inside 10.10.0.0 255.255.0.0 10.18.2.1 1
route inside 10.11.0.0 255.255.0.0 10.18.2.1 1
route inside 10.16.0.0 255.254.0.0 10.18.2.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 30
console timeout 0
no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:dad29feb197cd7defb2298e103a95426
: end
While I have this config loaded, I have a constant ping running in the background on a host that is addressed as 10.17.2.100, who is one hop down from 10.18.2.1, on the inside interface. I know the packets are arriving:
cisco-asa-5505# capture test interface inside match icmp any any
cisco-asa-5505# show capture test
25 packets captured
1: 02:38:32.025618 802.1Q vlan#182 P0 10.17.2.100 > 10.19.2.1: icmp: echo request
2: 02:38:32.737068 802.1Q vlan#182 P0 10.18.2.1 > 10.18.2.2: icmp: echo request
3: 02:38:32.737281 802.1Q vlan#182 P0 10.18.2.2 > 10.18.2.1: icmp: echo reply
4: 02:38:33.025496 802.1Q vlan#182 P0 10.17.2.100 > 10.19.2.1: icmp: echo request
5: 02:38:33.749183 802.1Q vlan#182 P0 10.18.2.1 > 10.18.2.2: icmp: echo request
6: 02:38:33.749427 802.1Q vlan#182 P0 10.18.2.2 > 10.18.2.1: icmp: echo reply
7: 02:38:34.025389 802.1Q vlan#182 P0 10.17.2.100 > 10.19.2.1: icmp: echo request
8: 02:38:34.758826 802.1Q vlan#182 P0 10.18.2.1 > 10.18.2.2: icmp: echo request
9: 02:38:34.759070 802.1Q vlan#182 P0 10.18.2.2 > 10.18.2.1: icmp: echo reply
10: 02:38:35.025526 802.1Q vlan#182 P0 10.17.2.100 > 10.19.2.1: icmp: echo request
And this mirrors the actual results on the wire:
cisco-asa-5505# packet-tracer input inside icmp 10.17.2.100 8 0 10.19.2.1
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.19.2.0 255.255.255.0 outside
Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
NAT doesn't seem to be happening either:
cisco-asa-5505# show nat
NAT policies on Interface inside:
match ip inside 10.17.2.0 255.255.255.0 inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
match ip inside 10.17.2.0 255.255.255.0 _internal_loopback any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
match ip inside 10.17.2.0 255.255.255.0 outside any
dynamic translation to pool 1 (10.19.2.3)
translate_hits = 0, untranslate_hits = 0
And I have no ACLs:
cisco-asa-5505# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
alert-interval 300
cisco-asa-5505#
Would love more ideas to try! Thanks in advance.
