0

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. All devices being used are Cisco ASAs. Site A is one subnet 10.10.108.0/22 and Site B is also a single subnet 10.20.10.0/24. Clients using ASA1 as their default gateway have no issues connecting to Site B. Any client that I put on ASA2 for a default gateway can ping back and forth to Site B clients, but there is no data access. Looking at my nicely drawn picture, PC2 and PC3 can ping each other. However, that is it. I have set an ACL on ASA2 to permit traffic to Site B. ASA2 also has a static route to send all Site B traffic to ASA1, therefore to go through the P2P. I've tried entering a NAT rule on ASA2 as follows, and this may be where I'm messing up.

nat (inside,inside) source static SiteB-lan SiteB-lan destination static SiteA-lan SiteA-lan no-proxy-arp route-lookup

Site B knows to send all Site A traffic back through the P2P that connects to ASA1. ASA1 sends traffic to and from the P2P without any issue, unless its the traffic coming from ASA2, which is the same subnet as all of the other inside traffic that it passes. Weird thing is, if you check out the photo, PC2 and PC3 can ping each other, no problem, but can't pass any data. Not sure what I'm missing here. Appreciate any feedback.

Network

Improve this question
2
  • Please edit your question to include the software versions and the configurations. Also, remember that a NAT table is local to the single device, and you should not NAT between devices inside your network.
    – Ron Maupin ♦
    Commented Feb 25, 2019 at 16:01
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 14, 2019 at 20:25

1 Answer 1

Reset to default
2

Simply put: don't NAT. NAT is required when connecting private-to-public or public-to-private. Since you're connecting private-to-private, NAT is uncalled for.

With ping working, your routing is working. If nothing else is working your ACLs filter out desired traffic. Check ACL statistics or use packet capturing to see where the filtering is happening.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.