1

I have a WAN interface and 2 LAN interface. I need both the LAN be able to access a server outside the network via the WAN (outside) interface. I am using a ASA 5510 firewall instead of a router, because I don't have a router.

It looks simple enough but it does not work. I ping from the a PC (172.16.22.8) connected to LAN (inside) Network to 10.10.10.1 which is the WAN local interface also did not work.

But from the ASA Firewall, I could ping my LAN (inside) PC. I followed a config i get from this forum. However, it did not work. Below my config. Please help.

interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 10.10.10.1 255.255.255.0 

!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 172.16.22.254 255.255.255.0 

!
interface Ethernet0/2
 nameif inside2
 security-level 50
 ip address 172.16.21.254 255.255.255.0 

!

access-list outside-inside extended permit ip any any 
access-list outside-inside extended permit icmp any any 

static (inside,outside) 172.16.22.0 172.16.22.0 netmask 255.255.255.0 
static (outside,inside) 10.10.10.0 10.10.10.0 netmask 255.255.255.0 

access-group outside-inside in interface outside
10
  • 1
    Did you allow ICMP on the outside interface? Mar 27, 2013 at 4:42
  • not sure how to do that. i thought the access-list will take care of that. When i issue sh access-list, i noticed there is no hit Mar 27, 2013 at 4:56
  • I add the following but it still not able to ping : icmp permit any outside Mar 27, 2013 at 5:12
  • The packets are ingressing on the "inside" interface, therefore that access list has no bearing since it is set as an "input" filter on the outside interface. You could try make another access list and setting that on the inside and see what happens. Mar 27, 2013 at 5:25
  • 2
    I'd advise downloading the Configuration, CLI and ASDM manuals for 7.0 from the Cisco website, and reading them rather than grabbing configs from some forum - you need to learn how to use your equipment. If you are just starting out, or don't expect to deal with your firewall often, ASDM may be a shallower learning curve for configuring the ASA. Finally, if this is ASA isn't being used in production yet, I would suggest upgrading it to the most recent version it will support (depending on how much memory is installed in the ASA).
    – dunxd
    Mar 28, 2013 at 10:47

1 Answer 1

1

It looks simple enough but it does not work. I ping from the a PC (172.16.22.8) connected to LAN (inside) Network to 10.10.10.1 which is the WAN local interface also did not work.

An ASA will not allow you to ping it's interface on the other side of the firewall, so, if you are connected to Ethernet0/1, you will not be able to ping Ethernet0/0, even though you might be allowed to ping something connected to Ethernet0/0. It is just one of the quirks of the ASA.

The reason your clients can't connect to the server, might not be because of the firewall, but because of routing. Does your client know that in order to reach 10.10.10.0/24, the need to go through 172.16.22.254 and does you server also know that in order to reach 172.16.22.0/24, it needs to go through 10.10.10.1?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .