ASA Firewall questions ●●●●●●

[fangwen meng]

guys:

ASA firewall ios version 9.0

pc1--(inside)-----ASA-----(outside)----pc2

i want  pc1 and pc2  can  ping  each  each other, and  can   Visit each other .

if  like a router, do not use nat .   how can i do ??

If you can give me some configuration

thank you verymuch....

[Jouni Forss]

Hi,

Well it pretty much depends on the setup.

If you only have a firewall deployed between 2 internal networks then you dont need NAT configurations at all. Naturally you will have to allow the traffic in the interface ACLs in question and make sure all route configurations are correct if there is more devices than the ASA involved.

Its hard to give any configurations when we dont know any address spaces and other related information.

- Jouni

[fangwen meng]

thank you verymuch.

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 1.1.1.1  255.255.255.0

!

interface GigabitEthernet0/1

nameif outside

security-level 0

ip address 2.2.2.1  255.255.255.0

access-list  111   permit icmp any any

access-list  111   permit ip any any

access-group 111 in interface inside

access-group 111 in interface outside

route outside 0.0.0.0 0.0.0.0   2.2.2.2

PC1  IP 1.1.1.2

      mask 255.255.255.0

      gateway 1.1.1.1

PC2 IP  2.2.2.2

mask 255.255.255.0

      gateway 2.2.2.1

now, pc1 can  ping  pc2 .  but  pc2 can not ping  pc1.

[Jouni Forss]

Hi,

Lets use "packet-tracer" to test.

Insert this command in the CLI of the ASA and post the output (if you have changed the actual IP address then use the real ones in the command)

packet-tracer input outside icmp 2.2.2.2 8 0 1.1.1.2

Though there is always a chance that a software firewall on the PC1 is blocking the ICMP and simply doesnt reply to the ICMP Echo at all. That might be worth checking out.

- Jouni

[fangwen meng]

pc1 <------> pc2     

if without the asa , they Can be connected to each other through

the   firewall configuration  have   problem ？

What do you think  

thanks

[Jouni Forss]

Hi,

I posted the "packet-tracer" command that you should issue on the ASA to tell us if there is a problem.

Without I can't really tell what the problem is.

Post the output

- Jouni

[jumora]

Please check PC firewall settings, in some case also antivirus settings have network protection. Also check ARP table and logs on the ASA but as Jouni indicates please forward packet-tracer output.

[jumora]

Do you still need assistance?

Please rate our assistnce