ASA5510 unable communication between eth0/1 and eth0/2

Answered Question
Jan 21st, 2010

I have seen some previous posts regarding this matter but the solution is not quite clear.  Here is my issue:


I have a ASA5510 that has the following configuration:

ethernet 0/0 outside security level 0
ethernet 0/1 inside security level 100      (192.168.2.0/24)
ethernet 0/2 private security level 100      (192.168.3.0/24)

same−security−traffic permit inter−interface

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.3.0 255.255.255.0
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
nat (private) 0 access-list nonat
nat (private) 1 0.0.0.0 0.0.0.0


The servers on both were able to access internet. However, they cannot talk to each other. When I ping between 2 sides, the firewall log showed:

portmap translation creation failed for icmp src Inside:192.168.2.151dst private:192.168.3.101(type 8, code 0)

I am not sure what do I miss. Can anyone help?

Thanks in advance

I have this problem too.
0 votes
Correct Answer by Kureli Sankar about 7 years 3 days ago

Your access-list appears incorrect.

Pls. change it to the following:

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0

-KS

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Kureli Sankar Thu, 01/21/2010 - 19:49

Your access-list appears incorrect.

Pls. change it to the following:

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0

-KS

vilaxmi Thu, 01/21/2010 - 20:05

Hello,

I see that you are facing assymetric routing issue in your n/w.

Is the default gateway of users behind Private and inside ifc the ASA itself or do you have a layer 3 device like router ? If you have one. then let the router handle the inter subnet communication.

Should you not have any router, then you could try using TCP State Bypass mechanism in ASA (8.2(x) + only).

Please read more about tcp-state-bypass method to overcome assymetric routing issues:

http://cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html

HTH

Vijaya

Actions

This Discussion