Solved: ASA5510 unable communication between eth0/1 and eth0/2

members1st · ‎01-21-2010

I have seen some previous posts regarding this matter but the solution is not quite clear. Here is my issue:

I have a ASA5510 that has the following configuration:

ethernet 0/0 outside security level 0
ethernet 0/1 inside security level 100 (192.168.2.0/24)
ethernet 0/2 private security level 100 (192.168.3.0/24)

same−security−traffic permit inter−interface

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.3.0 255.255.255.0
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
nat (private) 0 access-list nonat
nat (private) 1 0.0.0.0 0.0.0.0

The servers on both were able to access internet. However, they cannot talk to each other. When I ping between 2 sides, the firewall log showed:

portmap translation creation failed for icmp src Inside:192.168.2.151dst private:192.168.3.101(type 8, code 0)

I am not sure what do I miss. Can anyone help?

Thanks in advance

Kureli Sankar · ‎01-21-2010

Your access-list appears incorrect.

Pls. change it to the following:

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0

-KS

View solution in original post

Kureli Sankar · ‎01-21-2010

Your access-list appears incorrect.

Pls. change it to the following:

access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0

-KS

members1st · ‎01-22-2010

After change the access-list and it works.

Thank you so much.

vilaxmi · ‎01-21-2010

Hello,

I see that you are facing assymetric routing issue in your n/w.

Is the default gateway of users behind Private and inside ifc the ASA itself or do you have a layer 3 device like router ? If you have one. then let the router handle the inter subnet communication.

Should you not have any router, then you could try using TCP State Bypass mechanism in ASA (8.2(x) + only).

Please read more about tcp-state-bypass method to overcome assymetric routing issues:

http://cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html

HTH

Vijaya