cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1438
Views
0
Helpful
4
Replies

ASA packet flow

sistemas.sede
Level 1
Level 1

Hi everybody,

My question is: I have an ASA5505 as default gateway (192.168.60.101/24), and a CME router in the same network (192.168.60.254/24) which has others subnets behind, 192.168.61.0/24 (VoIP) & 10.1.10.0/252 (CUE). All my computers has the ASA as default gateway. My problem is, If I try to reach from any computer to the 192.168.61.0/24 network, the ASA does not allow giving an error like this:

Example for ICMP:

"Deny inbound icmp src inside:192.168.60.13 dst inside:192.168.61.1 (type 8, code 0)"

From the firewall rules, I give access from any inbound to inbound traffic, but does not work. I know the packet flow is peculiar because it goes out from the same interface that it came (inside), but it might be possible, isn't' it?

Thanks a lot,

Antonio.

4 Replies 4

August Ritchie
Level 1
Level 1

Hello,

This problem is due to the fact that you need to hairpin the traffic back through the inside interface. The ASA doesn't allow u-turning traffic by default, but this document should show you how.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2

As a note you will want to change you static (inside,inside) to read something like this.

static (inside,inside) 192.168.61.0 192.168.61.0 netmask 255.255.255.255

Then the rest would be the same

same-security-traffic permit intra-interface

global (inside) 1 interface

Kureli Sankar
Cisco Employee
Cisco Employee

Antonio,

Pls. let the router do the routing.

Make sure all your inside computers have the CME(192.168.60.254) as the gateway.  The CME router should have its default gateway pointing to the ASA.

-KS

Thank you for your quick answers, I will try the differents solutions.

Regards.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: