Starting inbound sessions from the directly connected outside subnet

[aacole]

Hi, I recall from the PIX days that inbound sessions were not permitted from a host directly connected into the subnet assigned to the outside interface on the firewall.

I have been asked to advise on a test setup, where we need to test inbound sessions, and it was proposed that the test host be placed in the outside subnet. I suggested that we have a router conected to the outside subnet, but some decided its too complex!

Does this restriction apply to ASA runing 8.x code?

[Jouni Forss · Accepted solution]

Hi,

I am not sure I am aware of the limitation you mention. Then again I havent really been in touch with PIXs other than the few that still are in some networks.

I did a quick test for my home ASA running 8.4(5)

I made a Static NAT for my internal networks Router and allowed management connection from the ISP core and logged to the core device and attempted the management connection and it worked just fine. The source IP address for the management connection is from the directly connected subnet between the core and my ASA and the destination IP address was also a IP address from that same subnet.

So any such limitation should not be present.

- Jouni

[aacole]

Wow, thanks for quick reply Jouni!

That answers my question.