Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA setup with two interfaces:

inside: / SecLevel:100 outside: / SecLevel: 0

I have a static route setup to allow PCs on the inside network to access the internet via a gateway on the outside interface (3.254):


This all works fine.

I now need to be able to access a PC on the outside interface (3.253) from a PC on the inside interface on port 35300. I understand I should be able to do this with no problems, as I'm going from a higher security level to a lower one. However I can't get any connection.

Do I need to set up a seperate static route? Perhaps the route above is overriding what I need to be able to do (is it routing ALL traffic through the gateway?)

Any advice on how to do this would be apprecaited.

I am configuring this via ASDM but the config can be seen as below:

Result of the command: "show running-config"

: Saved
ASA Version 8.2(5) 
hostname ciscoasa
domain-name xxx.internal


name description Internal Dev server

name Newserver
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address 
interface Vlan2
 nameif outside
 security-level 0
 ip address 
time-range Workingtime
 periodic weekdays 9:00 to 18:00
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server Newserver
 domain-name xxx.internal
same-security-traffic permit inter-interface
object-group service Mysql tcp
 port-object eq 3306
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list inside_access_in extended permit ip any any 
access-list outside_access_in remark ENABLES OUTSDIE ACCESS TO DEV SERVER!
access-list outside_access_in extended permit tcp any interface outside eq www time-range Workingtime inactive 
access-list outside_access_in extended permit tcp host interface outside eq ssh 
access-list inside_access_in_1 extended permit tcp any any eq www 
access-list inside_access_in_1 extended permit tcp any any eq https 
access-list inside_access_in_1 remark Connect to SSH services
access-list inside_access_in_1 extended permit tcp any any eq ssh 
access-list inside_access_in_1 remark Connect to mysql server
access-list inside_access_in_1 extended permit tcp any host object-group Mysql 
access-list inside_access_in_1 extended permit tcp any host eq 3312 
access-list inside_access_in_1 extended permit object-group TCPUDP host Newserver any eq domain 
access-list inside_access_in_1 extended permit icmp any any 
access-list inside_access_in_1 remark Draytek Admin
access-list inside_access_in_1 extended permit tcp any eq 4433 
access-list inside_access_in_1 remark Phone System
access-list inside_access_in_1 extended permit tcp any eq 35300 log disable 
pager lines 24
logging enable
logging asdm warnings
logging from-address
logging recipient-address level errors
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ipv6 access-list inside_access_ipv6_in permit tcp any any eq www 
ipv6 access-list inside_access_ipv6_in permit tcp any any eq https 
ipv6 access-list inside_access_ipv6_in permit tcp any any eq ssh 
ipv6 access-list inside_access_ipv6_in permit icmp6 any any 
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1
static (inside,outside) tcp interface www www netmask 
static (inside,outside) tcp interface ssh ssh netmask 
access-group inside_access_in in interface inside control-plane
access-group inside_access_in_1 in interface inside
access-group inside_access_ipv6_in in interface inside
access-group outside_access_in in interface outside
route outside 10
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL 
aaa authentication enable console LOCAL 

share|improve this question
Static route shouldn't be a problem; a connected route takes precedence. Can you try running a packet-tracer simulating the traffic, and provide us that output? – Shane Madden Jun 1 '12 at 16:54
can you post the config here – user1008764 Jun 1 '12 at 18:02
Do you have any NAT rules dynamic or static, your right about the security level but I've never trusted it to work and generally find it good practice to add any rules I need. I agree with Shane run a packet tracer, it's pretty good at finding faults – Chris Jun 1 '12 at 19:23
If I do a packet trace between (me) and (device) it works fine. If I do the reverse, > it drops the packet at 'rpf-violated Reverse Path verify failed). I'm not sure if this matters though as the connections will always be initiated on the 192.168.2.x PC first – Ben Jun 6 '12 at 10:11
Config posted above, thanks – Ben Jun 6 '12 at 10:16

Do you have any access lists permitting that traffic? E.g. What does the outbound ACL look like? Are you setting this up via the command line only?

If you have access to the ASDM, run the packet tracer wizard to simulate the traffic you need.

share|improve this answer
I've just updated my original comment with config – Ben Jun 7 '12 at 8:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.