• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1912
  • Last Modified:

Cisco ASA 8.4 denies packets between two internal subnets

Hello. Our basic config.. - ASA 8.4 (5510) - router to subnet

asa has route..

route inside 1

asa can ping 10.10.15.x hosts, however we can't communicate with them, and get this error on the asa:

Deny inbound UDP from to on interface inside

Current config is almost out of the box.

I have tried creating access-lists and network object, but my knowledge is weak, so no success. If someone could please tell me which lines to add and break it down to me, I would very much appreciate it.

Should be a very basic question, no VLANs or anything.

  • 4
  • 2
1 Solution
jmeggersSr. Network and Security EngineerCommented:
Looks like the host is sending to the ASA when it should be sending to the  The ASA won't redirect, so my guess is that's why it's denying the packet.  Is the host ( using the ASA as its default gateway?  Since the ASA won't redirect, I believe it should be using the router as its default gateway instead.
arthurk123Author Commented:
Yes, the ASA is the default gateway, it is replacing our existing Peplink firewall

The router is just a point to point T1 connection to another office up the street

I am not trying to link different interfaces with different subnets, just stop the ASA from denying the above packets...

I refuse to believe the ASA won't do this. Even a 50 dollar Linksys has the option to put in static routes...
Need to turn on same security traffic. That allows traffic with the same security level to cross the ASA including going in and out the same interface.

same-security-traffic permit {inter-interface | intra-interface}

inter-interface - Permits communication between different interfaces that have the same security level.
intra-interface - Permits communication in and out of the same

Become an IT Security Management Expert

In today’s fast-paced, digitally transformed world of business, the need to protect network data and ensure cloud privacy has never been greater. With a B.S. in Network Operations and Security, you can get the credentials it takes to become an IT security management expert.

arthurk123Author Commented:
Thank you, you are GOD!

I did run a packet trace and got...

Phase: 1
Subtype: input
Result: ALLOW
Additional Information:
in   inside

Phase: 2
Result: DROP
Implicit Rule
Additional Information:

input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

I thought same security traffic was only for different interfaces talking to each other, not same interface.

Thank you many times!
arthurk123Author Commented:
Exact answer I needed
This has bit me before - ;-)

Please mark my answer as helpful, I'm trying to earn points for my membership
arthurk123Author Commented:
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now