Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sadly I have gone back in time to ASA 8.2(5)33 which I am not so familiar with. I have configured NAT between two interfaces but traffic isn't passing becasue I can't get the ACL to work;

(The full config which isn't very big is here but to keep this post tidy I have just pasted the important parts below);

interface Ethernet0/0
 switchport access vlan 108
!
interface Ethernet0/6
 switchport access vlan 104
!             
interface Ethernet0/7
 switchport access vlan 105
!             
interface Vlan104
 description BUILDING2
 nameif BUILDING2
 security-level 0
 ip address 10.104.0.1 255.255.255.0 
!             
interface Vlan105
 description BUILDING1
 nameif BUILDING1
 security-level 0
 ip address 10.105.0.1 255.255.255.0 
!             
interface Vlan108
 description Main LAN VLAN
 nameif lan   
 security-level 0
 ip address 172.22.0.215 255.255.255.0 
!
object-group network obj_net_Remote_Hosts
 network-object host 111.111.111.3
 network-object host 111.111.111.65
object-group network obj_host_pc1_eth1
 network-object host 10.104.0.111
object-group network obj_host_pc2_eth1
 network-object host 10.104.0.112
object-group network obj_host_pc3_eth1
 network-object host 10.104.0.106
object-group network obj_host_pc4_eth1
 network-object host 10.104.0.107
object-group network obj_net_PCs
 description IPs of PCs
 group-object obj_host_pc1_eth1
 group-object obj_host_pc2_eth1
 group-object obj_host_pc3_eth1
 group-object obj_host_pc4_eth1
access-list acl_NAT_pc1_91 extended permit tcp host 10.104.0.111 host 111.111.111.3 eq 8101 
access-list acl_Permit_PCs extended permit tcp object-group obj_net_PCs object-group obj_net_Remote_Hosts eq 8101 
!
global (BUILDING1) 11 111.111.222.91 netmask 255.255.255.255
nat (BUILDING2) 11 access-list acl_NAT_pc1_91
access-group acl_Permit_PCs in interface BUILDING2
route BUILDING1 111.111.111.3 255.255.255.255 10.105.0.2 1
route BUILDING1 111.111.111.65 255.255.255.255 10.105.0.2 1

When I try and connect from PC1 to ip 111.111.111.3 I see the following error logged on the ASA console;

%ASA-2-106001: Inbound TCP connection denied from 10.104.0.111/38495 to 111.111.111.3/8101 flags SYN  on interface blades

What the duce!

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You need to enable same-security-traffic.

same-security-traffic enable inter-interface

Or change one of the interfaces security level

share|improve this answer
    
Oh man, that seems obvious now, either way I needed anothers opinion, thank you :) –  jwbensley Nov 28 '12 at 9:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.