ASA 5510 setup/routing

[SOL10]

hi there

i have an ASA5510 with the following setup:

e0 - outside interface-212.188.x.x/28

e1 - inside if - 192.168.3.x/24 into 2960sw pport 10 vlan 1-switchport access

e2 - dmz if - 172.16.x.x/24 into port 14 vlan 40 switchport access.

linux server plugged into port 14 vlan40 ip 172.16.x.x/24 g/w dmz interface.

windows server plugged into port 15 vlan1 ip 192.16.3.x/24. g/w inside interface

both the windows server and linux server can ping their default gateways but i cant seem to ping each server across the network or establish an ssh connection to the liinux box.

the sh route command on the asa shows the 3 connected n/w (outside,inside&dmz).

I can get to the internet fromt the inside thatis ok

when i try to ping the windows erver from the linuxbox i get network unreachable. below are the access lists:

access-list 106 line 1 extended permit tcp host 192.168.3.x host 172.16.10.x eq ssh (hitcnt=9)

access-list 106 line 2 extended permit icmp any any (hitcnt=148)

access-list 106 line 3 extended permit ip any any (hitcnt=122)

access-group 106 in interface inside

Any ideas? Plese help as im really baffled.

Thnkx

[srue]

access-list dmz_in permit icmp any any echo

access-list dmz_in permit ip any any

access-group dmz_in in interface dmz

you have to explicitly allow icmp in an interface.

and of course the "permit ip any any" isn't the most secure option for a dmz, but you get the idea.

[SOL10]

hi there, i tried that but still no joy. when i try to open an ssh conenction from 192.168.3.x/24 to 172.16.10.x i get conenction refused, when i look at the loggin is ASDM i get:

portmap translation creation failed for tcp src inside:192.168.3.x/3481 dst dmz:172.16.10.x/22

any ideas what im doing wrong?

[sundar.palaniappan]

You are probably missing NAT for access from inside to DMZ. Try this config.

static (inside,DMZ) 192.168.3.0 192.168.3.0 netmask 255.255.255.0

BTW, this disables translation and is also called static identity NAT. Linux Server on the DMZ would see the real address of the inside Windows server.

You may want to do a 'clear xlate' after adding the static command.

HTH

Sundar

[SOL10]

sundar,

its not working.im puling my hair out. fromthe linux box, when i ping 192.168.3.5 i get network unreachable.

[branfarm1]

I don't know if this will help but there's also an icmp permit command (use the context help for more information: icmp permit ? ). For instance, if you wanted to allow icmp from any host on your inside interface you would add: icmp permit any inside

Good luck.

[SOL10]

hi guys, thanks for all your help

the issue was not with the asa at all. it was the linux box, for some reason after you set up the ip addressing on the nic you have to enter a static route for the connected nw and also default route for all other traffic. weird but works