1

I can ping from pc0 to router0 in other way I can ping inside to outside, but I can't ping from router to pc0. In the other way I can't ping outside to inside, I don't know how to add this rule on ASA. I perform NAT for inside to outside can some one help me in this.(Note! nothing is configure on switch its just a unmanaged switch but i need it for my lab. thank you.

This is my Topology :

Topology

running config on asa :

  interface GigabitEthernet1/1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    !
    interface GigabitEthernet1/2
     nameif outside
     security-level 0
     ip address 10.1.1.2 255.255.255.0
    !
    object network INSIDE
    subnet 192.168.1.0 255.255.255.0
    !
    route outside 0.0.0.0 0.0.0.0 10.1.1.1 1
    !
    !
    !
    object network INSIDE
    nat (inside,outside) dynamic interface
    !
    !
    !
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    policy-map global_policy
    class inspection_default
    inspect icmp 
    !
    service-policy global_policy global

I Perfrom these commands on ASA , the switch is just unmanaged nothing is configured on it, and i also enable dhcp on ASA subnet 192.168.1.10-192.168.1.20

# object network INSIDE
This NAT is for the inside subnet, the private network
# subnet 192.168.1.0 255.255.255.0
Now, I will configure NAT
# nat (inside,outside) dynamic interface
# conf t
# class-map inspection_default
# match default-inspectioin-traffic
# exit
# policy-map globac_policy
Specify the class i created
# class inspection_default
# inspect icmp
# exit
I will enable the service policy
# service-policy global_policy global
3
  • You're using NAT, so 192.168.1.0/24 doesn't exist outside the LAN. If you turn off NAT (pure routing), and tell things outside the LAN where 192.168.1.0/24 is, there are various ways to permit traffic from a lower security level to a higher security level.
    – Ricky
    Nov 26, 2020 at 15:02
  • @Ricky can u demonstrate a small piece of code . Nov 26, 2020 at 16:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 23:26

1 Answer 1

1

The outside doesn't know that the inside exists. So, the first step is to allocate an outside IP address that you want to represent the inside PC. The ASA will listen for this IP on its outside interface, rewrite the IP addresses on the packets, and transfer the packets to the inside. So, for example, let's say I allocated 10.1.1.15 as the NAT. The config would be something like this:

object network obj_pc0
 host 192.168.1.11
 nat (inside,outside) static 10.1.1.15

Now, just because you added a NAT doesn't mean the ASA will allow the flow. The ASA requires that you permit the traffic, also. So, you would just add it to your outside ACL. Your example doesn't have an outside ACL yet. So, to make one and apply it, you would do something like this:

object network obj_router0
 host 10.1.1.1
access-list outside_access_in ext permit object obj_router0 object obj_pc0 eq 3389
access-group outside_access_in in interface outside

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.