Cisco ASA 5505 Intra-interface routing issue

Question

I have the network topology in the following link please kindly refer it : http://www.gigapac.com/wp-content/uploads/2012/03/topology.png

1. A site to site IPSec VPN is running between the two Cisco routers.
2. The ASA firewall has two interfaces e0/0 (outside) and e0/1 (inside) and is currently configured to act as the default gateway for the PCs in the LAN.
3. I have also added a route in ASA which routes 192.168.51.0/24 via 192.168.139.253 (inside) interface.
4. The PC having IP address 192.168.139.21 cannot make RDP connection to 192.168.51.21. But when I set a static route in the PC and route 192.168.51.0/24 via 192.168.139.253 then the RDP session works.

5. I have also enabled the following command :

   same-security-traffic permit intra-interface

But still no luck. Do I need to do "no nat-control" or do some static translations?

Answer 1

The ASA is only seeing half of the traffic flow.

A SYN packet from the PC on 192.168.139.21 will be sent to the ASA, which will track it and then forward it to the route on 192.168.139.253. This router will send the SYN over to the router on 192.168.51.1, and on to the machine on 192.168.51.21.

A SYN+ACK packet will be sent back to the router on 192.168.51.1, across the IPSec tunnel to the router on 192.168.139.253, and to the PC without going via the ASA. When the ACK packet is sent from the client, the ASA will drop the packet as it hasn't seen the SYN+ACK back from the machine on 192.168.51.21.

To fix this, the ASA needs to see traffic in both directions. There are many solutions - one of them could be to move Fa0 of the 192.168.139.253 router to the outside interface of the ASA.