Showing results for 
Search instead for 
Did you mean: 

Troubleshooting 1-way connectivity between 6506 and ASA55xx


I haven't added to my entwork in a while, so I might be a bit rusty on LAN connectivity troubleshooting.

I have an ASA55xx that will be the L3 core of a new network infrastructure; the VLANs defined on the edge switches will trunk to a DMZ interface on the ASA and subinterfaces will route internally. My old network will connect via a "transit" DMZ interface and the outside interface will be configured as is typical.

My problem is that I only have 1-way connectivity between a ASA subinterface and my old network; a simple diagram is:

Servers -> subinterface ( -> DMZ interface -> [ASA55xx] -> transit interface -> [6506] -> L3 VLAN ( -> My workstation

I can ping from the ASA to my workstation at 10.10.3.x, but I cannot ping the subinterface from my workstation.

I suspect that it might be a NAT issue, but configuring NAT bypass did nothing.

Partial ASA config:



interface Ethernet0/0

nameif outside

security-level 0

ip address xx.xx.xx.xx yy.yy.yy.yy


interface Ethernet0/1

no nameif

no security-level

no ip address


interface Ethernet0/1.162

description VLAN-162

vlan 162

nameif inside162

security-level 100

ip address


interface Ethernet0/1.179

description BACKBONE

vlan 179

nameif inside179

security-level 100

ip address


interface Ethernet0/2

no nameif

no security-level

no ip address


interface Ethernet0/2.200

description VLAN-200-TKRDMZ

vlan 200

nameif dmz200

security-level 50

ip address


interface Ethernet0/3

nameif transit

security-level 75

ip address


access-list transit-nat-bypass extended permit ip interface transit



global (outside) 1 interface

nat (transit) 0

nat (inside162) 0 access-list transit-nat-bypass

nat (inside162) 1

nat (dmz200) 1


route outside xx.xx.xx.xx

route transit 1

route inside179 1

I can provide Cat6500 config lines also, but I don't think that the issue lies there.

Any opinions will be welcomed.


8 Replies 8

Reza Sharifi
Hall of Fame Expert Hall of Fame Expert
Hall of Fame Expert

From the 6506, can you ping the ASA (

Thanks for your reply;

No, I cannot ping the ASA from the 6506; however, the ASA can ping the 6506 and my workstation beyond. I also noted that the ASA doesn't show up in a 'show cdp neighbors' on the 6506.

Can you check and see if the 6500 has a static route towards the firewall  (

if not, add it and test again.

There is a static route in place:

ip route

Hi drumrby,

You can ping the 6506 from the ASA do you have any managment interface / other onterface between the ASA anf 6506 that may explain why you can ping the 6506.

Can you run the command

sh int ip brief on the ASA to check if the interface are up

Kind Regards,


The only interface that connects my old network to the new one is the 'transit' interface; the output of the command is:

ASA1# sh int ip brief

Interface                  IP-Address      OK? Method Status                Protocol

Ethernet0/2                unassigned      YES unset  up                    up 

Ethernet0/2.188       YES CONFIG up                    up 

Ethernet0/2.200       YES manual up                    up

From the 6506 can you ping ?

Do you have any ACLs ? by default higher security level can access lower security level If I can remeber for ICMP you need to specially allow it or you need to do some inspection on ICMP

If not try testing on L2 (this will avoid any ACL / Security Zones you may have)

Try testing with L2 configure L2 vlan ID 200 on the 6506 and plug in a laptop in a port in vlan 200 using an IP address in 10.10.200.x

I hope this helps.

You should try to ping servers instead as DMZ interface's security level normally doesn't allow pinging.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers