October 12, 2008 05:50am pdt

My Account

Top 15 Experts

Overall Top Experts

1lrmoore 2,360,186
2batry_boy 969,050
3rsivanandan 347,634
4grblades 345,860
5PeteLong 299,073
6nodisco 277,487
7calvinetter 254,590
8MrHusy 225,546
9Voltz-dk 222,809
10Cyclops3... 211,396
11tim_holman 120,177
12JFrederic... 119,100
13carribeant... 108,132
14mkielar 105,219
15keith_ala... 104,419

	[x] Attachment Details

Problem with ACL config on Cisco ASA

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.0

Zones: Cisco PIX Firewall, Network Routers, Networking Hardware Firewalls

Tags: Cisco, ASA, 5505, ACL Issue

Due to a recent company acquisition we need to transplant a network within another network at a customer site temporarily (~5 days). Network in a box so to speak. The transplanted network which will consist of just 3 servers and 3 workstations and has to maintain its original IP scheme so it can function as before (DC, Citirix server, File-sharing, etc.).

Current network: 192.100.1.0 /24
Transplanted network: 192.168.1.0 /24

Here is the setup:

Cisco ASA 5505 -----------(switches)---------------------Netgear RP614----------(workstations/servers)

Outside: 74.11.11.11:: Inside: 192.168.1.0 /24 ----------Outside: 192.168.1.145 :: Inside: 192.168.20.0 /24

I'm sure I have necessary static routing setup properly on both the sides (Cisco ASA and Netgear router). From the 192.168.20.0 /24 network I can ping anything on the 192.168.1.0 /24 network and access the internet. However, I cannot ping/telnet/etc. into the 192.168.20.0 /24 network from the 192.168.1.0 /24 netoworking.

When I run a Packet Trace from the Cisco ASA the issue seems to be in the inside, inbound ACL but the ACL is wide open for that connection and even the 192.168.20.0 /24 network is even explicitly allowed. I will add the sanitized config for the ASA below. Any help would be greatly appreciated. Thanks.

Here is the deny statement from the ACL on the ASA:

Deny inbound icmp src inside:192.168.1.25 dst inside:192.168.20.250 (type 8, code 0)

	#	Title
	1	ACL problems cisco ASA 5505
	2	Cisco ASA ACL seems ignored
	3	Outbound ACLs on Cisco ASA 5505?
	4	No incoming POP or SMTP with new A…
	5	ASA ACL/NAT command questions
	6	Open RPC port on a ASA 5505