Link to home
Start Free TrialLog in
Avatar of futurenetwings
futurenetwings

asked on

from inside LAN user are not able to ping outside world with Cisco ASA active-active failover

We have created two context one "context-a" and another one "context-b" in the primary asa5520 and failover is working properly with secondary asa5520 but users can't communicate with the outside . But from Primary ASA's context-a and admin context we are able to ping outside like 4.2.2.2 with outside interface we are able to ping any public ip, (right now we are not using context-b). If we are trying ping from user pc then we are not able to ping to the outside. Right now we are using only one isp link and the gateway is 63.219.7.1. We have attach one pc to primar asa's inside port and given ip to the user pc is 172.16.120.100/24. from pc we are only able to inside ip of the primay asa nothing else.

Admin context:
Inside: 172.16.120.4/24 standby 172.16.120.8
outside: 63.219.7.20 /27 standby 63.219.7.19
DMZ: 192.168.1.8 /24 standby 192.168.1.9
Default gateway of outside: 63.219.7.1

Context-a IP:
Inside: 172.16.120.2/24 standby 172.16.120.5
outside: 63.219.7.30 /27 standby 63.219.7.21
DMZ: 192.168.1.1 /24 standby 192.168.1.12
Default gateway of outside: 63.219.7.1

Total all context from primary asa was replicated to the secondary asa. But we are not able to get internet access from inside zone.
We are trying to trouble shot from asdm's packet tracer where souce ip was inside ip from context-a and destination ip 4.2.2.2 and result output showing packet was blocked by Access-List.
Please give us a solution.
mail-to-expert-170409.txt
ASKER CERTIFIED SOLUTION
Avatar of Voltz-dk
Voltz-dk
Flag of Denmark image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial