Outside host not able to access inside host on Home ASA5505 to Verizon Router (ISP) Setup

[CiscoBrownBelt]

See attachment.

So network OUT to IN goes from Verizon Router (ISP) >>>>Outside PC>>>>Switch>>>ASA>>>>Server and Laptop.

I will probably do away with the unmanaged (so allows anything) switch but leaving things as is for now.

I have a very basic config for now.

Everything internal (Laptop and Server) can ping anything on the Outside of the ASA including accessing the internet. 

The problem is nothing on the outside can ping/access anything on the inside and I have ACLs allowing ALL traffic for now. 

I tried creating a route on the Verizon router for inside LAN (192.168.15.0 - wild card not supported - to 192.168.1.2) even though I don't think I need it since internal hosts can access the net but I did it anyway.

Here is the ASA config:

ciscoasa# sh run
: Saved
:
: Serial Number: JMX184940D6
: Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
:
ASA Version 9.1(7)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
shutdown
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
switchport access vlan 15
!
interface Ethernet0/6
switchport access vlan 15
!
interface Ethernet0/7
shutdown
!
interface Vlan1
no nameif
no security-level
no ip address
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface Vlan10
no forward interface Vlan2
nameif management
security-level 100
no ip address
!
interface Vlan15
nameif inside
security-level 100
ip address 192.168.15.254 255.255.255.0
!
ftp mode passive
object network InternalLan
subnet 192.168.15.0 255.255.255.0
access-list Inside extended permit ip any any
access-list Outside extended permit ip any any
pager lines 24
mtu management 1500
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-717.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network InternalLan
nat (inside,outside) dynamic interface
access-group Outside in interface outside
access-group Inside in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.217 255.255.255.255 management
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:3fffb2fed77cd3121b45038824155eec

[Seb Rupik · Accepted solution]

Hi there,

I suspect your NAT statement

!
object network InternalLan
  nat (inside,outside) dynamic interface
!

...is the source of your problems. For the outside_host this will be NAT’ing the return traffic to outside interface ip 192.168.1.2 this will result in a reverse path failure.

What you need to do is add a NAT statement which prevents NAT being performed on traffic sourced from the inside subnet destined to the outside subnet.

!
object network OutsideLan
  subnet 192.168.1.0 255.255.255.0
!
nat (inside,outside) source static InternalLan InternalLan destination static OutsideLan OutsideLan no-proxy-arp route-lookup
!

Cheers,

Seb.

[CiscoBrownBelt]

Great!
I actually fixed it before I looked at your posts.
Turns out my laptop would not ping anyway as native FW was blocking it. Yes once I removed NAT statement the I was able to access my server from Outside the ASA. You nailed it! Thanks!