Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Routing problem with ASA5520

Hi

I am having issues with routing on 2 ASA 5520 and wondering if anyone can help.

Attached is some of the running config.

The setup is basically 2 asa 5520s running in a active/active configuration.

3 out of the four interfaces are used and one for failover between each box.

I have an interface dedicated to each zone as such:

Core (inside) 10.1.0.0

DMZ 10.8.0.0

Outside 11.1.0.0

Now I have been trying to enable routing between the inside interface and the DMZ, and vice versa.

For example I would like a host in the inside zone to be able to ping a host in the DMZ.

I have added exception for ICMP and also allow it both ways. To which it doesn't appear to work, also tried the same but for a host inside to connect to a web server in the dmz.

Everytime I run the packet trace wizard in the ASDM it is almost like the ACL rules and not being picked up and am told that the implicit deny is causing the packet to be dropped?

I have tried many combinations of nat exemptions and acl rules

Any ideas?

6 REPLIES

Re: Routing problem with ASA5520

Why do you have 3 ACL's applied to the inside interface and 2 applied to the DMZ?

access-group Core_access_in_1 in interface Core control-plane

access-group outside-in-acl in interface Core

access-group Core_access_out out interface Core

access-group outside-in-acl in interface DMZ

access-group DMZ_access_out out interface DMZ

New Member

Re: Routing problem with ASA5520

I believe the ASDM created them the first time I used it.

New Member

Re: Routing problem with ASA5520

Verify your NAT rule or turn off the NATing from inside to DMZ.

New Member

Re: Routing problem with ASA5520

I have added a nat exmeption rule and tried specifying both explicit source and destinations ip addresses of the hosts as well as any any but still doesn't seem to route.

Bronze

Re: Routing problem with ASA5520

Hello,

I belive the problem is with ACL "outside-in-acl". This has been applied to both the DMZ and Core interfaces. So you need to allow icmp echo and icmp echo-reply on this ACL ie

access-list outside-in-acl extended permit icmp any any echo

access-list outside-in-acl extended permit icmp any any echo-reply

Please try adding and let us know the result.

Regards

New Member

Re: Routing problem with ASA5520

Hi

I've tried to add that rule to any and all access-lists just in case and still get the same result.

If I used the built in packet inspection tool it seems that the implicit deny deny is causing the packet to be dropped.

I have also tried to follow the information on http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

and still seem to end up with the same result.

Have you got any other sugesstions you could help with?

116
Views
0
Helpful
6
Replies
CreatePlease login to create content