ASA 5506x configured new interface.  Outbound works but no inbound traffic.

Posted on 2016-10-18
Last Modified: 2016-10-31
I added a 2nd interface to ASA 5506x running 9.4 (2) 6 asdm 7.5 (2) 153 and configured it with a 2nd ISP.  I now have Outside and Outside2.

I configured dynamic PAT and am able to send traffic out and receive replies (tested ping, http).  This was done by setting a static route to use Outside2's gateway for test sites and then browsing/pinging from inside network.

However I have created several object NAT rules to forward RDP and HTTPS traffic.  I have used the packet tracer to verify all ACLs are correct and NAT would work.  However nothing works.  I have enabled PING (icmp permit host (my IP) Outside2) however I am unable to ping.  I have enabled HTTPS management access on Outside2 for my IP as well however I get nothing.

No pings, no ASDM, no inbound traffic.  Outbound traffic works fine.  

I have compared all configuration between the two outside interfaces but am unable to see anything which would cause this issue.  ACL's, NAT, interface settings are all the same.

Any ideas?
Question by:YMartin
  • 3
  • 2
LVL 16

Expert Comment

ID: 41850420
I'm afraid you are in the wrong direction ...
ASA is not a router and cannot manage two ISPs, unless you use the dual-isp failover functionality.
It will never act as load balancing and I'm afraid it will never let you publish natted public IPs on a data line different from the one managed by default gateway (e.g.: ip route <RouterIP>)

The only thing that will work with static routes is the way you have configured it (e.g.: outbound for specific sites).

hope this helps

Author Comment

ID: 41852307
Hi Max.  

Thank you.  

What I am trying to do is this:
However the PAT rules must also survive the failover.  Are you saying this will never work with PAT involved?

I am seeing where the ASA does have some routing capability.

One other point worth mentioning is that we also have a T1 interface configured.  I am able to ping and reach ASDM through the T1 interface.
LVL 16

Expert Comment

ID: 41857098
the link you posted says right what I said:

Note: Load balancing does not occur in this example.
The DSL connection is idle as long as the leased line is active and the primary ISP gateway is reachable. However, if the connection to the primary ISP goes down, the security appliance changes the routing table to direct traffic to the DSL connection. Static route tracking is used to achieve this redundancy.

It is just a failover dual ISP, it does not work with both data lines up and running


Accepted Solution

YMartin earned 0 total points
ID: 41860220
I was able to get this working.  There was a problem in the static route subnet mask causing the issue with responses to inbound traffic.  For some reason it was not affecting outbound.

Author Closing Comment

ID: 41866610
resolved it on my own.

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
VoIP Polycom Phones not working 30 50
WLC and radius 4 30
Network over eigrp 100 topology ? 3 63
SSH setup on ASA 5505 17 57
Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question