0

Recently our organisation has been supplied a new ASA 5506-X to replace the old good PIX506e for a project. We have encountered a problem on routed interface on ASA 5506, which is very different from ASA 5505. We could not get the traffic passed from the Outside to the Inside and vice versa. I understand that traffic flow from Inside to Outside is permitted by default.

Very high level network topology

As the diagram describes, these are the summary:

  1. Inside interface of ASA is configured with 192.10.5.253
  2. Outside interface of ASA is configured with 10.1.150.1
  3. Outside network has 4 VLANS, VLAN10 being the VLAN our workstation is sitting at, which carries IP of 10.1.10.201.
  4. There is a server in client's network, which has the IP of 192.10.5.3.
  5. Basically ASA 5506-X is acting as an router to route traffic between Inside and Outside network.
  6. There is a layer 3 switch in the outside network. Which has the static route to reach 192.10.5.0/24 via the gateway of 10.1.150.1.

ASA 5506-X configuration:

  1. Enabled allow traffic between same interfaces with security level.
  2. ACL permitting ANY ANY ICMP TCP on both Inside and Outside interface.
  3. NAT from outside network to inside network. (its a long list)
  4. Static route to 0.0.0.0/0 via 192.10.5.254(client's device IP) to WAN
  5. Static route to 10.1.0.0/16 network, via the gateway of 10.1.150.254 (VLAN interface IP in inside network layer 3 switch)

What's is working:

  1. Within the outside network, we have a layer 3 Ruggedcom switch. Where we configured inter-VLAN routing in it and it works fine. All 4 VLANs in outside network are able to communicate, and able to ping to 10.1.150.1.
  2. For client's network switch, its just a layer 2 switch and no VLAN segregation.
  3. All end devices can communicate within their own network.
  4. ASA 5506-X can ping to all equipment and all end devices.

What's is not working:

  1. Outside network end devices is unable to ping inside network end devices even with the static route is established.

I did some research and found out that ASA 5506-X does not allow communication between the interfaces? I even specified ACL to allow ANY traffic from source ANY to destination ANY. I am using ASA version 9.6. What could be going wrong here?

closed as off-topic by Tom K., Xander, LvB, Josef, symcbean Jun 12 '18 at 8:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Tom K., Xander, LvB, Josef, symcbean
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Would this question be better posed to Cisco support team? While you'll find people on SSE who might know specific products, it is probably still a good idea to go to the source. – Sas3 Aug 16 '17 at 2:41
  • 1
    I've flagged this as I don't deem it to be security related. Whilst ACLs are in-fact a "security" function and ASAs are a security appliance the question you're actually asking is not security related, you're asking how to configure routing which is a question better suited to Network Engineering Exchange. – J.J May 24 '18 at 17:31
  • "Outside network end devices is unable to ping inside network end devices even with the static route is established." This is normal to be so. What are you actually trying to accomplish ? – Overmind May 29 '18 at 11:12
3

Without you posting your config in here it's quite hard for me to help, however, I will attempt to give you an idea of why this might not be working.

Firstly, as you've stated by design you cannot ping an interface if you come from another interface, this is a security feature of the ASA and it is fully intended that way. This is sometimes known as a "Distant interface" - if you think about it, it's a good thing you cannot ping between interfaces, realistically you wouldn't want such a thing even if you think you do. I would like to add this can not be disabled.


Secondly, without altering your access rules you will not be able to achieve this either. There is a simple reason for this, the ASA has something called the Modular Policy Framework this is what is essentially stopping this operation from happening. By default, the MPF will not inspect ICMP traffic; in essence what this means is you will not be able to ping or traceroute from the inside to the outside. There are two ways you can achieve this.

  • Inspecting ICMP
  • Access rule to allow ping replies

By inspecting ICMP traffic this would subsequently allow this function, alternatively, you can add an access rule to allow the ping replies back in. Ideally, you would want to choose the first one as it's more secure. If you're not inspecting ICMP traffic it's within the realms of possibility for someone to issue an ICMP DoS attack otherwise known as a "Ping flood"

For inspecting ICMP traffic the following is an example of how you would achieve this.

SecSe# config t
SecSe(config)# policy-map global_policy
SecSe(config-pmap)#  class inspection_default
SecSe(config-pmap-c)# inspect icmp

In regards to the second option, a simple access-rule would be sufficient although as I've mentioned this is an ill-advised method.

SecSe# config t
SecSe(config)# access-list OUTSIDE_IN permit icmp any any echo-reply
SecSe(config)# access-group OUTSIDE_IN in interface outside

Thirdly, in regards to your final point, you may have a static route in but it will never work if you don't allow the traffic back in. The problem, here again, is you will need an access rule to allow that traffic into the ASA otherwise it's just going to drop it as that's how a firewall works.

As I said for me to help I will need your configuration but as I've mentioned this is a question which would be better suited on Network Engineer Exchange rather than here.

Not the answer you're looking for? Browse other questions tagged or ask your own question.