ASA quit passing traffic

[tsrader]

Inside to Outside can ping no problem

Outside to Inside CANNOT ping host.

Requirement is for outside host to be able to access inisde host.   (tcp / icmp, etc)

I am missing something on the firewall.

Relevant configs attached.

Thanks for any assistance.

[Jouni Forss · Accepted solution]

Hi,

You have Dynamic PAT configured for traffic initiated from behind "inside" to "outside"

You however do not have any Static NAT or NAT0 configured that would make it possible for a host on the "outside" to initiate a connection to a host behind the "inside".

With the current firewall configuration it wont be possible to initiate a connection in the direction you have described.

So I guess you would have to either remove any kind of NAT from the firewall OR configure Static NAT for the hosts behind "inside".

You seem to have Default Route on both Routers pointing towards the ASA interface IP address. This would mean you could use any IP address space as the NAT IP address towards the "outside" interface and the traffic should be forwarded correctly to the ASA "outside" interface.

To configure Static NAT for a host on the "inside" to the "outside" you could use the following configuration format

static (inside,outside) netmask 255.255.255.255

Then by targeting the NAT IP address you should be able to form connections to the host you configured Static NAT.

- Jouni