failed to locate egress interface for ICMP from inside...

ronin2307 · ‎05-06-2009

this is a bit of a double post so I apologize, but I need some help

the basics: 2 ASAs, 1 is between our office and the internet, the other is in our office and currently between the office network and another subnet I am using for testing

1st ASA (inside interface is on a 192.168.1.0 subnet, gives VPN clients 192.168.10.0 IPs)

2nd ASA (ouside interface is on the 192.168.1.0 subnet, inside subnet is 10.0.0.0)

I do have a question regarding the 2nd ASA config:

I have managed to set the ACL and NAT properly for the 192.168.1.0 network (this is where the outside interface of the ASA resides). However, when I VPN to my network, I am assigned an IP in the 192.168.10.0 subnet (that is what the firewall is configured to give VPN clients.

so 192.168.10.0 can talk to hosts on 192.168.1.0. no problems there. However when I tried to access an FTP server i set up on the 10.0.0.0 subnet (inside interface of the ASA, with proper NATing for a 192.168.1.13 IP to 10.0.0.10) the ASA dropped the packets (something about cannot find the egress interface for inside.....)

I am obviously missing something but I am not sure what I need to add to the config. Any help again will be extremely appreciated

Thanx

John Blakley · ‎05-06-2009

Ronin,

when I tried to access an FTP server i set up on the 10.0.0.0 subnet (inside interface of the ASA, with proper NATing for a 192.168.1.13 IP to 10.0.0.10)

Does the second ASA know how to get back to the 192.168.10.0 subnet? You may not need natting to this subnet.

Do you have a route like:

route (inside) 192.168.10.0 255.255.255.0 192.168.1.1 (or whatever the inside 1st ASA address is?)

HTH,

John

HTH, John *** Please rate all useful posts ***