Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sadly I have gone back in time to ASA 8.2(5)33 which I am not so familiar with. I have configured NAT between two interfaces but traffic isn't passing becasue I can't get the ACL to work;

(The full config which isn't very big is here but to keep this post tidy I have just pasted the important parts below);

interface Ethernet0/0
 switchport access vlan 108
interface Ethernet0/6
 switchport access vlan 104
interface Ethernet0/7
 switchport access vlan 105
interface Vlan104
 description BUILDING2
 nameif BUILDING2
 security-level 0
 ip address 
interface Vlan105
 description BUILDING1
 nameif BUILDING1
 security-level 0
 ip address 
interface Vlan108
 description Main LAN VLAN
 nameif lan   
 security-level 0
 ip address 
object-group network obj_net_Remote_Hosts
 network-object host
 network-object host
object-group network obj_host_pc1_eth1
 network-object host
object-group network obj_host_pc2_eth1
 network-object host
object-group network obj_host_pc3_eth1
 network-object host
object-group network obj_host_pc4_eth1
 network-object host
object-group network obj_net_PCs
 description IPs of PCs
 group-object obj_host_pc1_eth1
 group-object obj_host_pc2_eth1
 group-object obj_host_pc3_eth1
 group-object obj_host_pc4_eth1
access-list acl_NAT_pc1_91 extended permit tcp host host eq 8101 
access-list acl_Permit_PCs extended permit tcp object-group obj_net_PCs object-group obj_net_Remote_Hosts eq 8101 
global (BUILDING1) 11 netmask
nat (BUILDING2) 11 access-list acl_NAT_pc1_91
access-group acl_Permit_PCs in interface BUILDING2
route BUILDING1 1
route BUILDING1 1

When I try and connect from PC1 to ip I see the following error logged on the ASA console;

%ASA-2-106001: Inbound TCP connection denied from to flags SYN  on interface blades

What the duce!

share|improve this question
up vote 3 down vote accepted

You need to enable same-security-traffic.

same-security-traffic enable inter-interface

Or change one of the interfaces security level

share|improve this answer
Oh man, that seems obvious now, either way I needed anothers opinion, thank you :) – jwbensley Nov 28 '12 at 9:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.