ASA 5520 port forward not working

[brent.cowing]

I've configured port forwarding for SSH on a non standard port (8022) to be forwarded to an inside interface on port 22.  I've created my nat rule:

static (inside,outside)  tcp interface 8022 10.11.11.232 22 netmask 255.255.255.255

and I've created my access rule:

access-list outside_access_in line 9 extended permit tcp 0.0.0.0 0.0.0.0 interface outside eq 8022

I've done packet tracer and i've run wireshark, but not matter what, i don't see any packets getting to my inside host (10.11.11.232).  logs show:

Built inbound TCP connection 45801 for outside:xxx.xxx.xxx.xxx/63308 (xxx.xxx.xxx.xxx/63308) to inside:Ratin_Decoder/22 (xxx.xxx.xxx.xxx/8022

So i'm thinking that the nat rule and the access list are good, but that somehow there is a route that is preventing the packet from getting to my inside host.  Yet, i can ping my inside host when ssh'd into the asa.

So, i'm at a complete loss, can someone help???

[Jennifer Halim]

Can you please share your ASA configuration so we can check if there could be other configuration that might prevent the access.

If you try to telnet on port 8022 from the outside, does that open the connection?

Also, I assume that you get a hitcount on your access-list line 9 when you try to SSH from the outside?

[brent.cowing]

I think I've identified the issue.  After some more wiresharking, I was able to see that packets were infact getting to my internal host.  But nothing was getting back out.

I think this is due to a dual gateway setup I have.  The default gateway for my host is set up to go back out a different public IP than what it is coming in on.  If I manually set the default gateway on my host to be the same as the gateway my port forward is on, then it works.

Should my dual gateway setup work?  Or am I being less than smart thinking it should?

Thanks for the response.

[Jennifer Halim]

Thanks for the update and yes, you have exactly identified the issue. ASA is expecting traffic of the same session to go in and out from the same interface, ie: internal interface. If it receives packet of existing connection on a different interface, it will drop the packet.