Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is an issue I've been struggling with for quite some time, with a seemingly simple answer (Aren't all IT problems?).

And that is the problem of passing traffic between two directly connected subnets with an ASA

While I'm aware that best practice is to have Internet -> Firewall -> Router, in many cases this isn't possible.

For example, In have an ASA with two interfaces, named OutsideNetwork ( and InternalNetwork ( You'd expect Outside to be able to get to, say,, or at LEAST, but pinging the interface gives only bad news.

Result of the command: "ping OutsideNetwork"
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 0 percent (0/5)

Naturally, you'd assume that you could add a static route, to no avail.

[ERROR] route Outsidenetwork 1
Cannot add route, connected route exists

At this point, you might gander if its a NAT or Access list problem.

access-list Outsidenetwork_access_in extended permit ip any any
access-list Internalnetwork_access_in extended permit ip any any

There is no dynamic nat (or static nat for that matter), and Unnatted traffic is permitted.

When I try pinging the above address ( from Outsidenetwork), I get this error message from level 0 logging (debugging).

Routing failed to locate next hop for icmp from NP Identity Ifc: to Outsidenetwork:

This led me to set same-security traffic permit, and assigned the same, lesser and greater security numbers between the two interfaces.

Am I overlooking something obvious? Is there a command to set static routes that are classified higher than connected routes?

share|improve this question
up vote 4 down vote accepted

There's a few problems in your question. First, I wouldn't naturally think that I could get to the inside network from the outside network. The ASA is a FIREWALLL not a router. If it did this, it wouldn't be doing its job. A router will do that just fine.

The second major problem is with your route command. You don't need it. You have 2 locally connected networks. The firewall knows how to reach both of them. They are directly connected. Thus, you don't need a route command to tell the firewall what the next hop is.

With that stuff out of the way, let's get to an answer. The ASA requires every network to have a security level attached to it from 0-100. A higher security level will be able to access a lower security level. A lower security level needs explicit access granted to resources at a higher level. So let's start by assigning the proper security levels:

interface ethernet 0/0
nameif outside
security-level 0
ip address

interface ethernet 0/1
nameif inside
security-level 100
ip address

Now your inside network is allowed to access your outside network. If you need to allow your outside network to access your inside network, you need to define that in an access-list and assign it to the interface in an access group:

access-list outside_access_in extended permit ip any any
access-group outside_access_in in interface outside

But it's still not working? Probably because you need to define static mappings from one network to the other. Otherwise the firewall doesn't know what to do. Remember, this is a firewall, not a router:

static (inside,outside) netmask
static (outside,inside) netmask

That's should have free flow between the 2 interfaces...really defeats the purpose of a firewall, but it seems to be what you want. At least it gives you a starting point and you can restrict traffic from there.

share|improve this answer

I'm not positive - but there's nothing apparently wrong with your setup - I think the problem is in the tests you are trying to do.

Telling the router to ping one interface with the other as a source address is something I'm not sure would work - it may assume that you mean you want the traffic to leave that interface - in which case it's correct, is has no route to that IP.

Have you tried testing connectivity from external devices, rather than from the router itself?

As long as you don't have some ACLs or NAT in place, and as long as the other devices have appropriate routes to reach this thing, I can't see any reason this isn't just plain old routing...

share|improve this answer
I thought the same thing, but not just the router is affected, all hosts in can communicate with the outside world just fine, just not anything in the subnet of one of the other ASA interfaces. I'm not just using a different IP address instead, but it still confuses the hell out of me. – Zephyr Pellerin Sep 26 '10 at 23:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.