Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

ASA 5506x configured new interface.  Outbound works but no inbound traffic.

Posted on 2016-10-18
Last Modified: 2016-10-31
I added a 2nd interface to ASA 5506x running 9.4 (2) 6 asdm 7.5 (2) 153 and configured it with a 2nd ISP.  I now have Outside and Outside2.

I configured dynamic PAT and am able to send traffic out and receive replies (tested ping, http).  This was done by setting a static route to use Outside2's gateway for test sites and then browsing/pinging from inside network.

However I have created several object NAT rules to forward RDP and HTTPS traffic.  I have used the packet tracer to verify all ACLs are correct and NAT would work.  However nothing works.  I have enabled PING (icmp permit host (my IP) Outside2) however I am unable to ping.  I have enabled HTTPS management access on Outside2 for my IP as well however I get nothing.

No pings, no ASDM, no inbound traffic.  Outbound traffic works fine.  

I have compared all configuration between the two outside interfaces but am unable to see anything which would cause this issue.  ACL's, NAT, interface settings are all the same.

Any ideas?
Question by:YMartin
  • 3
  • 2
LVL 16

Expert Comment

ID: 41850420
I'm afraid you are in the wrong direction ...
ASA is not a router and cannot manage two ISPs, unless you use the dual-isp failover functionality.
It will never act as load balancing and I'm afraid it will never let you publish natted public IPs on a data line different from the one managed by default gateway (e.g.: ip route <RouterIP>)

The only thing that will work with static routes is the way you have configured it (e.g.: outbound for specific sites).

hope this helps

Author Comment

ID: 41852307
Hi Max.  

Thank you.  

What I am trying to do is this:
However the PAT rules must also survive the failover.  Are you saying this will never work with PAT involved?

I am seeing where the ASA does have some routing capability.

One other point worth mentioning is that we also have a T1 interface configured.  I am able to ping and reach ASDM through the T1 interface.
LVL 16

Expert Comment

ID: 41857098
the link you posted says right what I said:

Note: Load balancing does not occur in this example.
The DSL connection is idle as long as the leased line is active and the primary ISP gateway is reachable. However, if the connection to the primary ISP goes down, the security appliance changes the routing table to direct traffic to the DSL connection. Static route tracking is used to achieve this redundancy.

It is just a failover dual ISP, it does not work with both data lines up and running


Accepted Solution

YMartin earned 0 total points
ID: 41860220
I was able to get this working.  There was a problem in the static route subnet mask causing the issue with responses to inbound traffic.  For some reason it was not affecting outbound.

Author Closing Comment

ID: 41866610
resolved it on my own.

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question