08-09-2010 10:52 AM - edited 03-11-2019 11:22 AM
Hi everybody,
My question is: I have an ASA5505 as default gateway (192.168.60.101/24), and a CME router in the same network (192.168.60.254/24) which has others subnets behind, 192.168.61.0/24 (VoIP) & 10.1.10.0/252 (CUE). All my computers has the ASA as default gateway. My problem is, If I try to reach from any computer to the 192.168.61.0/24 network, the ASA does not allow giving an error like this:
Example for ICMP:
"Deny inbound icmp src inside:192.168.60.13 dst inside:192.168.61.1 (type 8, code 0)"
From the firewall rules, I give access from any inbound to inbound traffic, but does not work. I know the packet flow is peculiar because it goes out from the same interface that it came (inside), but it might be possible, isn't' it?
Thanks a lot,
Antonio.
08-09-2010 10:58 AM
Hello,
This problem is due to the fact that you need to hairpin the traffic back through the inside interface. The ASA doesn't allow u-turning traffic by default, but this document should show you how.
08-09-2010 11:02 AM
As a note you will want to change you static (inside,inside) to read something like this.
static (inside,inside) 192.168.61.0 192.168.61.0 netmask 255.255.255.255
Then the rest would be the same
same-security-traffic permit intra-interface
global (inside) 1 interface
08-09-2010 12:26 PM
Antonio,
Pls. let the router do the routing.
Make sure all your inside computers have the CME(192.168.60.254) as the gateway. The CME router should have its default gateway pointing to the ASA.
-KS
08-10-2010 12:28 AM
Thank you for your quick answers, I will try the differents solutions.
Regards.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: