Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ASA 5505. We could not get the traffic passed from the Outside to the Inside and vice versa. I understand that traffic flow from Inside to Outside is permitted by default.
As the diagram describes, these are the summary:
- Inside interface of ASA is configured with 18.104.22.168
- Outside interface of ASA is configured with 10.1.150.1
- Outside network has 4 VLANS, VLAN10 being the VLAN our workstation is sitting at, which carries IP of 10.1.10.201.
- There is a server in client's network, which has the IP of 22.214.171.124.
- Basically ASA 5506-X is acting as an router to route traffic between Inside and Outside network.
- There is a layer 3 switch in the outside network. Which has the static route to reach 126.96.36.199/24 via the gateway of 10.1.150.1.
ASA 5506-X configuration:
- Enabled allow traffic between same interfaces with security level.
- ACL permitting ANY ANY ICMP TCP on both Inside and Outside interface.
- NAT from outside network to inside network. (its a long list)
- Static route to 0.0.0.0/0 via 188.8.131.52(client's device IP) to WAN
- Static route to 10.1.0.0/16 network, via the gateway of 10.1.150.254 (VLAN interface IP in inside network layer 3 switch)
What's is working:
- Within the outside network, we have a layer 3 Ruggedcom switch. Where we configured inter-VLAN routing in it and it works fine. All 4 VLANs in outside network are able to communicate, and able to ping to 10.1.150.1.
- For client's network switch, its just a layer 2 switch and no VLAN segregation.
- All end devices can communicate within their own network.
- ASA 5506-X can ping to all equipment and all end devices.
What's is not working:
- Outside network end devices is unable to ping inside network end devices even with the static route is established.
I did some research and found out that ASA 5506-X does not allow communication between the interfaces? I even specified ACL to allow ANY traffic from source ANY to destination ANY. I am using ASA version 9.6. What could be going wrong here?