First, a disclosure: This is my first Cisco device ever. Only ever used dumb hubs/switches and computers before.

We need to use an ASA 5505 to route UDP traffic from one (otherwise air-gapped) private network (192.168.3.x, inside) to another (otherwise air-gapped) network (10.10.10.x, outside). Each network currently has < 5 machines connected by a simple unmanaged switch. The 5505 will have its one outside port connected to the outside switch and its one inside port connected to the inside switch. Traffic is only allowed to flow from inside to outside not the reverse, hence UDP.

I've managed to get it to work for ONE machine on the outside, by setting that machine's address as the gateway. However, it is NOT actually a gateway, it is just a Windows desktop, so this will not work for my actual requirements. But I cannot figure out how to have the firewall just route all traffic received from the inside to the outside network. It is probably quite simple, but it escapes me.

Oh, we've not yet been able to get anything to connect via telnet or SSH to the 5505, but we (barely) managed to get the web/java interface to work from a Windows Embedded Standard 7 desktop (one of the inside machines). Apologies in advance if this is an inappropriate question here.

My running-config.cfg values (from a backup made by the GUI) are:

 Cryptochecksum: f11dee8e 05035a66 fe2a7a49 813a2eed 
 : Saved
 : Written by enable_15 at 10:02:20.369 UTC Wed Apr 13 2016
 ASA Version 8.2(5) 
 hostname ciscoasa
 interface Ethernet0/0
  switchport access vlan 2
 interface Ethernet0/1
 interface Ethernet0/2
 interface Ethernet0/3
 interface Ethernet0/4
 interface Ethernet0/5
 interface Ethernet0/6
 interface Ethernet0/7
 interface Vlan1
  nameif inside
  security-level 100
  ip address 
 interface Vlan2
  nameif outside
  security-level 0
  ip address 
 ftp mode passive
 pager lines 24
 logging asdm informational
 mtu inside 1500
 mtu outside 1500
 icmp unreachable rate-limit 1 burst-size 1
 no asdm history enable
 arp timeout 14400
 global (outside) 1 interface
 nat (inside) 1
 route outside 1
 timeout xlate 3:00:00
 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
 timeout tcp-proxy-reassembly 0:01:00
 timeout floating-conn 0:00:00
 dynamic-access-policy-record DfltAccessPolicy
 http server enable
 http inside
 no snmp-server location
 no snmp-server contact
 snmp-server enable traps snmp authentication linkup linkdown coldstart
 crypto ipsec security-association lifetime seconds 28800
 crypto ipsec security-association lifetime kilobytes 4608000
 telnet timeout 5
 ssh timeout 5
 console timeout 0
 dhcpd auto_config outside
 dhcpd address inside

 threat-detection basic-threat
 threat-detection statistics access-list
 no threat-detection statistics tcp-intercept
 class-map inspection_default
  match default-inspection-traffic
 policy-map type inspect dns preset_dns_map
   message-length maximum client auto
   message-length maximum 512
 policy-map global_policy
  class inspection_default
   inspect dns preset_dns_map 
   inspect ftp 
   inspect h323 h225 
   inspect h323 ras 
   inspect rsh 
   inspect rtsp 
   inspect esmtp 
   inspect sqlnet 
   inspect skinny  
   inspect sunrpc 
   inspect xdmcp 
   inspect sip  
   inspect netbios 
   inspect tftp 
   inspect ip-options 
 service-policy global_policy global
 prompt hostname context 
 no call-home reporting anonymous
 : end

I hope that is useful. Thanks for looking at this.

  • which software version do you run on the ASA? Can you add the configuration in your question?
    – JFL
    Apr 13, 2016 at 18:52
  • If you can tell me how to GET the configuration in a form that would be useful, I'll be glad to add it. ASA Version 8.2 (5) and Manager software version 6.4 (5). Apr 13, 2016 at 19:02
  • If you want you can come to chat
    – JFL
    Apr 13, 2016 at 19:06
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 1:21

1 Answer 1


Here's partial answer (to the SSH problem):

First, you need to generate the encryption keys

ip domain-name mycorp.com
crypto key generate rsa modulus 2048

Next, you need to configure user accounts

username jfl privilege 15 password opensesame
!<additional accounts>
aaa authentication ssh console local

Finally, allow SSH from the desired addresses

ssh inside
ssh version 2
  • (typed while smiling) Thanks for the info, but I'm not sure how to use CLI instructions in order to obtain access to the CLI itself, which is what I've not yet figured out how to get working. However, that wasn't my real problem (which has been resolved by removing the static route I'd added). I just mentioned that I have no CLI access because a CLI-only solution would not have helped me. Thanks anyway, though, for trying. Apr 14, 2016 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.