02-12-2019 08:31 AM - edited 02-21-2020 08:48 AM
Hi everyone!
I have two hosts:
192.168.1.227 <--> outside (static 192.168.1.2)
192.168.2.230 <--> inside_1 (static 192.168.2.1)
I can ping sucessfully from 192.168.1.227 --> 192.168.2.230,
but not from 192.168.2.230 --> 192.168.1.227 (timeout).
My configuration:
: Serial Number: JAD223000VX
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
: Written by enable_15 at 15:03:52.549 UTC Tue Feb 12 2019
!
ASA Version 9.8(2)
!
hostname ciscoasa
enable password $sha512$5000$BOpTSSo8HMFL8hZMk1Q8Ug==$S+zhKxWHBuw20kILyhW1kQ== pbkdf2
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface GigabitEthernet1/2
nameif inside_1
security-level 0
ip address 192.168.2.1 255.255.255.0
!
interface GigabitEthernet1/3
nameif inside_2
security-level 100
ip address 192.168.3.4 255.255.255.0
!
interface GigabitEthernet1/4
shutdown
nameif inside_3
security-level 100
no ip address
!
interface GigabitEthernet1/5
shutdown
nameif inside_4
security-level 100
no ip address
!
interface GigabitEthernet1/6
shutdown
nameif inside_5
security-level 100
no ip address
!
interface GigabitEthernet1/7
shutdown
nameif inside_6
security-level 100
no ip address
!
interface GigabitEthernet1/8
shutdown
nameif inside_7
security-level 100
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside_1 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
icmp unreachable rate-limit 10 burst-size 10
icmp permit any outside
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit any time-exceeded outside
icmp permit any unreachable outside
icmp permit any inside_1
icmp permit any echo inside_1
icmp permit any echo-reply inside_1
icmp permit any time-exceeded inside_1
icmp permit any unreachable inside_1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.3.0 255.255.255.0 inside_2
http 192.168.2.0 255.255.255.0 inside_1
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.2.0 255.255.255.0 inside_1
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:fe1c9b29d70c67665e24ff9f0a68525e
What can I do to make this work?
Thanks!
02-12-2019 08:57 AM
I just found: Ping in one way only
And the solution was configurating the Firewall on host 192.168.1.227.
Thanks for the attention.
02-12-2019 08:58 AM
Supasp,
It looks like a host firewall issue. As your interfaces have the same security level and there are no ACLs applied to them, the traffic should flow equally in both directions. As it does in one direction, but not in the other, I think it is host related.
02-12-2019 09:22 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide