I cant ping from Inside->Outside ,DMZ->Outside ,Inside->DMZ
Packet tracer in ASDM indicates access rule but i cannot see(click on the rule) , and i cannot create a reverse rule from Packet tracer. When i had a similar issue it was Nat issues.
Documentation and blogs are saying about how the Asa is using Xlate(Nat) rules to route traffic first prior to routing table and thus the failed to locate egress interface(cannot route traffic) if Nat fails.
Moreover Inside->DMZ etc do not suppose to require any Nat or access rules to work. Just in case i tried allow all traffic rules but did not help.
interface Ethernet0/0
nameif inside
security-level 100
ip address 10.0.10.1 255.255.255.0
!
interface Ethernet0/1
nameif DMZ
security-level 50
ip address 10.0.20.1 255.255.255.0
!
interface Ethernet0/2
nameif Outside
security-level 0
ip address 10.0.50.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup DMZ
dns domain-lookup Outside
same-security-traffic permit intra-interface
object network DMZtoOUT
subnet 10.0.20.0 255.255.255.0
object network DMZtoOUThttp
host 10.0.20.2
object network INStoOUTdyn
subnet 10.0.10.0 255.255.255.0
object network DMZtoOUTftp
host 10.0.20.2
object network INStoDMZ
subnet 192.168.1.0 255.255.255.0
object network InsideNetwork
subnet 10.0.10.0 255.255.255.0
object network TrustedUsers
subnet 10.0.50.0 255.255.255.128
object network UntrustedUsers
subnet 10.0.50.128 255.255.255.128
object network IntoOut
subnet 10.0.10.0 255.255.255.0
object network TEST
range 10.0.10.1 10.0.10.254
object network TEST2
range 10.0.20.1 10.0.20.254
object network FUCK
range 10.0.20.1 10.0.20.254
object network Insidenet
subnet 10.0.10.0 255.255.255.0
object network INStoOut
subnet 10.0.10.0 255.255.255.0
object network ANY
subnet 0.0.0.0 0.0.0.0
object network INtoOUT
subnet 10.0.10.0 255.255.255.0
object-group icmp-type ICMPALL
icmp-object alternate-address
icmp-object conversion-error
icmp-object echo
icmp-object echo-reply
icmp-object information-reply
icmp-object information-request
icmp-object mask-reply
icmp-object mask-request
icmp-object mobile-redirect
icmp-object parameter-problem
icmp-object redirect
icmp-object router-advertisement
icmp-object router-solicitation
icmp-object source-quench
icmp-object time-exceeded
icmp-object timestamp-reply
icmp-object timestamp-request
icmp-object traceroute
icmp-object unreachable
object-group service DMZservices
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
service-object tcp destination eq www
service-object tcp destination eq https
object-group network MAPPEDINDMZ
network-object object TEST
network-object object TEST2
access-list inside_access_in extended permit icmp any any
access-list Outside_access_in extended permit object-group DMZservices object TrustedUsers host 10.0.20.2
access-list Outside_access_in extended permit tcp object UntrustedUsers host 10.0.20.2 eq www
access-list InsideNet standard permit 10.0.10.0 255.255.255.0
access-list DMZ_access_in extended permit icmp any any object-group ICMPALL
access-list global_access extended permit icmp any any object-group ICMPALL
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu DMZ 1500
mtu Outside 1500
mtu management 1500
ip local pool VPNpool 10.0.10.100-10.0.10.200 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 10.0.20.0 255.255.255.0 inside
icmp permit 10.0.10.0 255.255.255.0 inside
icmp permit host 10.0.20.1 inside
icmp permit 10.0.10.0 255.255.255.0 DMZ
icmp permit 10.0.20.0 255.255.255.0 DMZ
no asdm history enable
arp timeout 14400
nat (inside,Outside) source static InsideNetwork InsideNetwork destination static InsideNetwork InsideNetwork
!
object network DMZtoOUT
nat (DMZ,Outside) dynamic interface
object network DMZtoOUThttp
nat (DMZ,Outside) static interface service tcp www www
object network DMZtoOUTftp
nat (DMZ,Outside) static interface service tcp ftp ftp
object network INtoOUT
nat (inside,Outside) dynamic interface
access-group DMZ_access_in in interface DMZ
access-group Outside_access_in in interface Outside
access-group global_access global
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server NewRad protocol radius
aaa-server NewRad (DMZ) host 10.0.20.3
timeout 5
key *****
authentication-port 1812
accounting-port 1813
http server enable
http 10.0.10.0 255.255.255.0 inside
dhcpd address 10.0.10.2-10.0.10.99 inside
dhcpd enable inside
!
dhcpd address 10.0.50.2-10.0.50.254 Outside
dhcpd enable Outside
!
dhcpd address 192.168.1.2-192.168.1.254 management
