Hairpinning issue with ASA 7.2(2)...

Unanswered Question
Oct 31st, 2007
User Badges:

Hi,


I'm trying to allow access from a remote office to a central office:

They're both connected to the inside interface.


I'm trying to get to a Print Server on 192.9.200.123 from 172.25.50.200. I thought it was a case of just enabling hairpinning. At the moment local users

can get out through the ASA but nothing remote can get back in. In the logs it's failing on 'nat (inside) 1 0.0.0.0 0.0.0.0'.


A little bit stumped at the minute... there's not much more configuration on the box than that below.



Some config:


same-security-traffic permit intra-interface

access-list inside-acl extended permit ip any any

access-list inside-acl extended permit icmp any any


global (inside) 1 interface

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0


static (inside,inside) 192.9.0.0 192.9.0.0 netmask 255.255.0.0

static (inside,inside) 172.25.0.0 172.25.0.0 netmask 255.255.0.0


access-group inside-acl in interface inside

access-group inside-acl in interface outside


route inside 192.9.0.0 255.255.0.0 172.25.50.1 1

route inside 172.25.0.0 255.255.0.0 172.25.50.1 1

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
acomiskey Wed, 10/31/2007 - 10:17
User Badges:
  • Green, 3000 points or more

You should not need those statics since you have


global (inside) 1 interface

nat (inside) 1 0 0


Give it a try without them.

pd-yca Tue, 11/27/2007 - 11:33
User Badges:

Something may have changed with the ASA, but I remeber hearing that the PIX could not route traffic back out the same interface it came in.

Actions

This Discussion