Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


ASA 5506x configured new interface.  Outbound works but no inbound traffic.

Posted on 2016-10-18
Medium Priority
Last Modified: 2016-10-31
I added a 2nd interface to ASA 5506x running 9.4 (2) 6 asdm 7.5 (2) 153 and configured it with a 2nd ISP.  I now have Outside and Outside2.

I configured dynamic PAT and am able to send traffic out and receive replies (tested ping, http).  This was done by setting a static route to use Outside2's gateway for test sites and then browsing/pinging from inside network.

However I have created several object NAT rules to forward RDP and HTTPS traffic.  I have used the packet tracer to verify all ACLs are correct and NAT would work.  However nothing works.  I have enabled PING (icmp permit host (my IP) Outside2) however I am unable to ping.  I have enabled HTTPS management access on Outside2 for my IP as well however I get nothing.

No pings, no ASDM, no inbound traffic.  Outbound traffic works fine.  

I have compared all configuration between the two outside interfaces but am unable to see anything which would cause this issue.  ACL's, NAT, interface settings are all the same.

Any ideas?
Question by:YMartin
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 17

Expert Comment

ID: 41850420
I'm afraid you are in the wrong direction ...
ASA is not a router and cannot manage two ISPs, unless you use the dual-isp failover functionality.
It will never act as load balancing and I'm afraid it will never let you publish natted public IPs on a data line different from the one managed by default gateway (e.g.: ip route <RouterIP>)

The only thing that will work with static routes is the way you have configured it (e.g.: outbound for specific sites).

hope this helps

Author Comment

ID: 41852307
Hi Max.  

Thank you.  

What I am trying to do is this:
However the PAT rules must also survive the failover.  Are you saying this will never work with PAT involved?

I am seeing where the ASA does have some routing capability.

One other point worth mentioning is that we also have a T1 interface configured.  I am able to ping and reach ASDM through the T1 interface.
LVL 17

Expert Comment

ID: 41857098
the link you posted says right what I said:

Note: Load balancing does not occur in this example.
The DSL connection is idle as long as the leased line is active and the primary ISP gateway is reachable. However, if the connection to the primary ISP goes down, the security appliance changes the routing table to direct traffic to the DSL connection. Static route tracking is used to achieve this redundancy.

It is just a failover dual ISP, it does not work with both data lines up and running


Accepted Solution

YMartin earned 0 total points
ID: 41860220
I was able to get this working.  There was a problem in the static route subnet mask causing the issue with responses to inbound traffic.  For some reason it was not affecting outbound.

Author Closing Comment

ID: 41866610
resolved it on my own.

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

596 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question