Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA setup with two interfaces:

inside: 192.168.2.254 / 255.255.255.0 SecLevel:100 outside: 192.168.3.250 / 255.255.255.0 SecLevel: 0

I have a static route setup to allow PCs on the inside network to access the internet via a gateway on the outside interface (3.254):

outside 0.0.0.0 0.0.0.0 192.168.3.254

This all works fine.

I now need to be able to access a PC on the outside interface (3.253) from a PC on the inside interface on port 35300. I understand I should be able to do this with no problems, as I'm going from a higher security level to a lower one. However I can't get any connection.

Do I need to set up a seperate static route? Perhaps the route above is overriding what I need to be able to do (is it routing ALL traffic through the gateway?)

Any advice on how to do this would be apprecaited.

I am configuring this via ASDM but the config can be seen as below:

Result of the command: "show running-config"

: Saved
:
ASA Version 8.2(5) 
!
hostname ciscoasa
domain-name xxx.internal

names

name 192.168.2.201 dev.xxx.internal description Internal Dev server

name 192.168.2.200 Newserver
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.254 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.3.250 255.255.255.0 
!
!
time-range Workingtime
 periodic weekdays 9:00 to 18:00
!
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server Newserver
 domain-name xxx.internal
same-security-traffic permit inter-interface
object-group service Mysql tcp
 port-object eq 3306
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list inside_access_in extended permit ip any any 
access-list outside_access_in remark ENABLES OUTSDIE ACCESS TO DEV SERVER!
access-list outside_access_in extended permit tcp any interface outside eq www time-range Workingtime inactive 
access-list outside_access_in extended permit tcp host www-1.xxx.com interface outside eq ssh 
access-list inside_access_in_1 extended permit tcp any any eq www 
access-list inside_access_in_1 extended permit tcp any any eq https 
access-list inside_access_in_1 remark Connect to SSH services
access-list inside_access_in_1 extended permit tcp any any eq ssh 
access-list inside_access_in_1 remark Connect to mysql server
access-list inside_access_in_1 extended permit tcp any host mysql.xxx.com object-group Mysql 
access-list inside_access_in_1 extended permit tcp any host mysql.xxx.com eq 3312 
access-list inside_access_in_1 extended permit object-group TCPUDP host Newserver any eq domain 
access-list inside_access_in_1 extended permit icmp any any 
access-list inside_access_in_1 remark Draytek Admin
access-list inside_access_in_1 extended permit tcp any 192.168.3.0 255.255.255.0 eq 4433 
access-list inside_access_in_1 remark Phone System
access-list inside_access_in_1 extended permit tcp any 192.168.3.0 255.255.255.0 eq 35300 log disable 
pager lines 24
logging enable
logging asdm warnings
logging from-address ben@xxx.com
logging recipient-address ben@xxx.com level errors
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ipv6 access-list inside_access_ipv6_in permit tcp any any eq www 
ipv6 access-list inside_access_ipv6_in permit tcp any any eq https 
ipv6 access-list inside_access_ipv6_in permit tcp any any eq ssh 
ipv6 access-list inside_access_ipv6_in permit icmp6 any any 
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface www dev.xxx.internal www netmask 255.255.255.255 
static (inside,outside) tcp interface ssh dev.xxx.internal ssh netmask 255.255.255.255 
access-group inside_access_in in interface inside control-plane
access-group inside_access_in_1 in interface inside
access-group inside_access_ipv6_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.3.254 10
route outside 192.168.3.252 255.255.255.255 192.168.3.252 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL 
aaa authentication enable console LOCAL 



share|improve this question
1  
Static route shouldn't be a problem; a connected route takes precedence. Can you try running a packet-tracer simulating the traffic, and provide us that output? –  Shane Madden Jun 1 '12 at 16:54
    
can you post the config here –  user1008764 Jun 1 '12 at 18:02
    
Do you have any NAT rules dynamic or static, your right about the security level but I've never trusted it to work and generally find it good practice to add any rules I need. I agree with Shane run a packet tracer, it's pretty good at finding faults –  Chris Jun 1 '12 at 19:23
    
If I do a packet trace between 192.168.2.150 (me) and 192.168.3.252 (device) it works fine. If I do the reverse, 192.168.3.252 > 192.168.2.150 it drops the packet at 'rpf-violated Reverse Path verify failed). I'm not sure if this matters though as the connections will always be initiated on the 192.168.2.x PC first –  Ben Jun 6 '12 at 10:11
    
Config posted above, thanks –  Ben Jun 6 '12 at 10:16

1 Answer 1

Do you have any access lists permitting that traffic? E.g. What does the outbound ACL look like? Are you setting this up via the command line only?

If you have access to the ASDM, run the packet tracer wizard to simulate the traffic you need.

share|improve this answer
    
I've just updated my original comment with config –  Ben Jun 7 '12 at 8:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.