0

I'm having an issue routing traffic from a backup gateway on a different ISP, to our main gateway, which uses a point to point connection to a data center, with the majority of our infrastructure. All devices being used are Cisco ASAs. Site A is one subnet 10.10.108.0/22 and Site B is also a single subnet 10.20.10.0/24. Clients using ASA1 as their default gateway have no issues connecting to Site B. Any client that I put on ASA2 for a default gateway can ping back and forth to Site B clients, but there is no data access. Looking at my nicely drawn picture, PC2 and PC3 can ping each other. However, that is it. I have set an ACL on ASA2 to permit traffic to Site B. ASA2 also has a static route to send all Site B traffic to ASA1, therefore to go through the P2P. I've tried entering a NAT rule on ASA2 as follows, and this may be where I'm messing up.

nat (inside,inside) source static SiteB-lan SiteB-lan destination static SiteA-lan SiteA-lan no-proxy-arp route-lookup

Site B knows to send all Site A traffic back through the P2P that connects to ASA1. ASA1 sends traffic to and from the P2P without any issue, unless its the traffic coming from ASA2, which is the same subnet as all of the other inside traffic that it passes. Weird thing is, if you check out the photo, PC2 and PC3 can ping each other, no problem, but can't pass any data. Not sure what I'm missing here. Appreciate any feedback.

Network

  • Please edit your question to include the software versions and the configurations. Also, remember that a NAT table is local to the single device, and you should not NAT between devices inside your network. – Ron Maupin Feb 25 at 16:01
2

Simply put: don't NAT. NAT is required when connecting private-to-public or public-to-private. Since you're connecting private-to-private, NAT is uncalled for.

With ping working, your routing is working. If nothing else is working your ACLs filter out desired traffic. Check ACL statistics or use packet capturing to see where the filtering is happening.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.