Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 47
  • Last Modified:

ASA 5506x configured new interface. Outbound works but no inbound traffic.

I added a 2nd interface to ASA 5506x running 9.4 (2) 6 asdm 7.5 (2) 153 and configured it with a 2nd ISP.  I now have Outside and Outside2.

I configured dynamic PAT and am able to send traffic out and receive replies (tested ping, http).  This was done by setting a static route to use Outside2's gateway for test sites and then browsing/pinging from inside network.

However I have created several object NAT rules to forward RDP and HTTPS traffic.  I have used the packet tracer to verify all ACLs are correct and NAT would work.  However nothing works.  I have enabled PING (icmp permit host (my IP) Outside2) however I am unable to ping.  I have enabled HTTPS management access on Outside2 for my IP as well however I get nothing.

No pings, no ASDM, no inbound traffic.  Outbound traffic works fine.  

I have compared all configuration between the two outside interfaces but am unable to see anything which would cause this issue.  ACL's, NAT, interface settings are all the same.

Any ideas?
0
YMartin
Asked:
YMartin
  • 3
  • 2
1 Solution
 
max_the_kingCommented:
Hi,
I'm afraid you are in the wrong direction ...
ASA is not a router and cannot manage two ISPs, unless you use the dual-isp failover functionality.
It will never act as load balancing and I'm afraid it will never let you publish natted public IPs on a data line different from the one managed by default gateway (e.g.: ip route 0.0.0.0 0.0.0.0 <RouterIP>)

The only thing that will work with static routes is the way you have configured it (e.g.: outbound for specific sites).

hope this helps
max
0
 
YMartinAuthor Commented:
Hi Max.  

Thank you.  

What I am trying to do is this:
http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/70559-pix-dual-isp.html
However the PAT rules must also survive the failover.  Are you saying this will never work with PAT involved?

I am seeing where the ASA does have some routing capability.

One other point worth mentioning is that we also have a T1 interface configured.  I am able to ping and reach ASDM through the T1 interface.
0
 
max_the_kingCommented:
Hi,
the link you posted says right what I said:

Note: Load balancing does not occur in this example.
The DSL connection is idle as long as the leased line is active and the primary ISP gateway is reachable. However, if the connection to the primary ISP goes down, the security appliance changes the routing table to direct traffic to the DSL connection. Static route tracking is used to achieve this redundancy.

It is just a failover dual ISP, it does not work with both data lines up and running

max
0
 
YMartinAuthor Commented:
I was able to get this working.  There was a problem in the static route subnet mask causing the issue with responses to inbound traffic.  For some reason it was not affecting outbound.
0
 
YMartinAuthor Commented:
resolved it on my own.
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now