If a host on 192.168.1.x, the inside interface tries to ping a host on 192.168.10.x (a network behind a router which is connected 6.1)
The ASA returns:
Jan 23 2010 10:17:58: %ASA-3-305006: portmap translation creation failed for icmp src inside:192.168.1.3 dst inside:192.168.10.22 (type 8, code 0)
and the ping fails.
If you try to ping directly from the ASA you get a similar result:
#ping 192.168.10.22 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.10.22, timeout is 2 seconds: Jan 23 2010 10:20:35: %ASA-4-313004: Denied ICMP type=0, from laddr 192.168.1.6 on interface inside to 192.168.1.1: no matching session
Seems to me this should work right out of the box, suggestions?
name 192.168.10.0 Cowacella description named after thomas J's Monticello with a cow twist
access-list inside_access_in_1 extended permit ip any any
nat-control global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0
You are running into assymetric routing scenario over here.
Either you can set the default gateway of hosts on all subnets to be the 6.1 (router) & have its default gateway set to the ASA inside ifc OR if you real,ly wanna keep the ASA as everybody's default gateway, then you can use the tcp-state-bypass feature introduced in 8.2 release of code for ASA, so that assymetric situation here can be handled correctly by ASA.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...