Hairpinning Fails

rafaelcervantes · ‎10-30-2009

Hi

I have two local subnets 192.168.1.0 and 192.168.2.0 behind another router. I hairpinning on the ASA (IP 192.168.1.252) to route traffic to the subnet 192.168.2.0.

I applied the next commands (I received help from pkampana to do this):

same-security-traffic permit intra-interface

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

route inside 192.168.2.0 255.255.255.0 192.168.1.254 1

If I ICMP echo using ASDM Packet Tracer works in both directions.

If I ping using a computer from subnet 192.168.1.0 to subnet 192.168.2.0 works.

If I ping using a computer from subnet 192.168.2.0 to subnet 192.168.1.0 fails.

If I remote desktop from any subnet fails and ASDM is logging the error that say:

severity: 6

Syslog ID: 106015

Source IP: 192.168.1.153

Destination IP: 192.168.2.4

Description: Deny TCP (no connection) from 192.168.1.153/1168 to 192.168.2.4/3389 flags RST on interface inside.

Thank you in advance.

RC

acomiskey · ‎10-30-2009

You could try this on the inside interface instead of your nat0 acl.

global (inside) 10 interface

nat (inside) 10 0 0

rafaelcervantes · ‎11-03-2009

when i first try to run this command I received the error

Result of the command: "nat (inside) 10 0 0"

Duplicate NAT entry

That is because I already have the command nat (inside) 1 0.0.0.0 0.0.0.0.

I changed this one: nat (inside) 1 0.0.0.0 0.0.0.0

for this one: nat (inside) 1 192.168.1.0 255.255.255.0. and applied the one that you give to me: nat (inside) 10 0 0 and global (inside) 10 interface but still does not work.

Thank you.

RC

acomiskey · ‎11-03-2009

Go back to your original way but remove one of these lines.

access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

Nat exemption is bidirectional so 1 line should be all you need.

rafaelcervantes · ‎11-04-2009

I already removed the line:

access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

Still does not work.

The syslog explanation of the error is :

The security appliance discarded a TCP packet that has no associated connection in the security appliance connection table. The security appliance looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is not an existing connection, the security appliance discards the packet.

Any help is greatly appreciated.

Thank you in advance.

RC.