Communicating routed interfaces for Cisco ASA 5506-X [closed]

Question

Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ASA 5505. We could not get the traffic passed from the Outside to the Inside and vice versa. I understand that traffic flow from Inside to Outside is permitted by default.

As the diagram describes, these are the summary:

1. Inside interface of ASA is configured with 192.10.5.253
2. Outside interface of ASA is configured with 10.1.150.1
3. Outside network has 4 VLANS, VLAN10 being the VLAN our workstation is sitting at, which carries IP of 10.1.10.201.
4. There is a server in client's network, which has the IP of 192.10.5.3.
5. Basically ASA 5506-X is acting as an router to route traffic between Inside and Outside network.
6. There is a layer 3 switch in the outside network. Which has the static route to reach 192.10.5.0/24 via the gateway of 10.1.150.1.

ASA 5506-X configuration:

1. Enabled allow traffic between same interfaces with security level.
2. ACL permitting ANY ANY ICMP TCP on both Inside and Outside interface.
3. NAT from outside network to inside network. (its a long list)
4. Static route to 0.0.0.0/0 via 192.10.5.254(client's device IP) to WAN
5. Static route to 10.1.0.0/16 network, via the gateway of 10.1.150.254 (VLAN interface IP in inside network layer 3 switch)

What's is working:

1. Within the outside network, we have a layer 3 Ruggedcom switch. Where we configured inter-VLAN routing in it and it works fine. All 4 VLANs in outside network are able to communicate, and able to ping to 10.1.150.1.
2. For client's network switch, its just a layer 2 switch and no VLAN segregation.
3. All end devices can communicate within their own network.
4. ASA 5506-X can ping to all equipment and all end devices.

What's is not working:

1. Outside network end devices is unable to ping inside network end devices even with the static route is established.

I did some research and found out that ASA 5506-X does not allow communication between the interfaces? I even specified ACL to allow ANY traffic from source ANY to destination ANY. I am using ASA version 9.6. What could be going wrong here?

Answer 1

Disclaimer: without you posting your config in here it's quite hard for me to help, however, I will attempt to give you an idea of why this might not be working.

Firstly, as you've stated by design you cannot ping an interface if you come from another interface on the same device, this is a security feature of the ASA and it is fully intended to be like this. This is whats known as a "Distant interface". If you think about it, it is a good thing you cannot ping between interfaces, realistically you wouldn't want such a thing even if you think you do. I would like to add this can not be disabled.

---

Secondly, without altering your access rules you will not be able to achieve this, there is a simple reason for that. The ASA has something called the Modular Policy Framework this is what is essentially stopping this operation from taking place. By default, the MPF will not inspect ICMP traffic. In essence what this means is you will not be able to ping or traceroute from the inside to the outside. There are two ways you can achieve this:

• Inspecting ICMP
• Access rule to allow ping replies

By inspecting ICMP traffic this would subsequently allow this function. Alternatively, you can add an access rule to allow the ping replies back in. Ideally, you would want to choose the first one as it is more secure. If you're not inspecting ICMP traffic it is within the realms of possibility for someone to issue an ICMP DoS attack otherwise known as a "Ping flood"

For inspecting ICMP traffic the following is an example of how you would achieve this:

SecSe# config t
SecSe(config)# policy-map global_policy
SecSe(config-pmap)#  class inspection_default
SecSe(config-pmap-c)# inspect icmp

In regards to the second option, a simple access-rule would be sufficient although as I've mentioned this is an ill-advised method:

SecSe# config t
SecSe(config)# access-list OUTSIDE_IN permit icmp any any echo-reply
SecSe(config)# access-group OUTSIDE_IN in interface outside

---

Thirdly, in regards to your final point, you may have a static route in but it will never work if you don't allow the traffic back in. The problem here is you will need an access rule to allow that traffic into the ASA otherwise it will implicitly drop it as that's how a firewall works.

As I said, for me to help further I will need your configuration but as I've mentioned this is a question which would be better suited on Network Engineering Exchange rather than here.