Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the network topology in the following link please kindly refer it : http://www.gigapac.com/wp-content/uploads/2012/03/topology.png

  1. A site to site IPSec VPN is running between the two Cisco routers.
  2. The ASA firewall has two interfaces e0/0 (outside) and e0/1 (inside) and is currently configured to act as the default gateway for the PCs in the LAN.
  3. I have also added a route in ASA which routes 192.168.51.0/24 via 192.168.139.253 (inside) interface.
  4. The PC having IP address 192.168.139.21 cannot make RDP connection to 192.168.51.21. But when I set a static route in the PC and route 192.168.51.0/24 via 192.168.139.253 then the RDP session works.
  5. I have also enabled the following command :

    same-security-traffic permit intra-interface

But still no luck. Do I need to do "no nat-control" or do some static translations?

share|improve this question
    
Can you run a packet-tracer simulating the attempt at an RDP connection? What device is handling the routing to the .51 network? –  Shane Madden Mar 31 '12 at 18:33

1 Answer 1

The ASA is only seeing half of the traffic flow.

A SYN packet from the PC on 192.168.139.21 will be sent to the ASA, which will track it and then forward it to the route on 192.168.139.253. This router will send the SYN over to the router on 192.168.51.1, and on to the machine on 192.168.51.21.

A SYN+ACK packet will be sent back to the router on 192.168.51.1, across the IPSec tunnel to the router on 192.168.139.253, and to the PC without going via the ASA. When the ACK packet is sent from the client, the ASA will drop the packet as it hasn't seen the SYN+ACK back from the machine on 192.168.51.21.

To fix this, the ASA needs to see traffic in both directions. There are many solutions - one of them could be to move Fa0 of the 192.168.139.253 router to the outside interface of the ASA.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.