I cant ping from Inside->Outside ,DMZ->Outside ,Inside->DMZ Packet tracer in ASDM indicates access rule but i cannot see(click on the rule) , and i cannot create a reverse rule from Packet tracer. When i had a similar issue it was Nat issues. Documentation and blogs are saying about how the Asa is using Xlate(Nat) rules to route traffic first prior to routing table and thus the failed to locate egress interface(cannot route traffic) if Nat fails.
Moreover Inside->DMZ etc do not suppose to require any Nat or access rules to work. Just in case i tried allow all traffic rules but did not help.

interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 
interface Ethernet0/1
 nameif DMZ
 security-level 50
 ip address 
interface Ethernet0/2
 nameif Outside
 security-level 0
 ip address 
interface Ethernet0/3
 no nameif
 no security-level
 no ip address
interface Management0/0
 nameif management
 security-level 100
 ip address 
ftp mode passive
dns domain-lookup inside
dns domain-lookup DMZ
dns domain-lookup Outside
same-security-traffic permit intra-interface
object network DMZtoOUT 
object network DMZtoOUThttp 
object network INStoOUTdyn 
object network DMZtoOUTftp 
object network INStoDMZ 
object network InsideNetwork 
object network TrustedUsers 
object network UntrustedUsers 
object network IntoOut 
object network TEST 
object network TEST2 
object network FUCK 
object network Insidenet 
object network INStoOut 
object network ANY 
object network INtoOUT 
object-group icmp-type ICMPALL
 icmp-object alternate-address
 icmp-object conversion-error
 icmp-object echo
 icmp-object echo-reply
 icmp-object information-reply
 icmp-object information-request
 icmp-object mask-reply
 icmp-object mask-request
 icmp-object mobile-redirect
 icmp-object parameter-problem
 icmp-object redirect
 icmp-object router-advertisement
 icmp-object router-solicitation
 icmp-object source-quench
 icmp-object time-exceeded
 icmp-object timestamp-reply
 icmp-object timestamp-request
 icmp-object traceroute
 icmp-object unreachable
object-group service DMZservices
 service-object tcp destination eq ftp 
 service-object tcp destination eq ftp-data 
 service-object tcp destination eq www 
 service-object tcp destination eq https 
object-group network MAPPEDINDMZ
 network-object object TEST
 network-object object TEST2
access-list inside_access_in extended permit icmp any any 
access-list Outside_access_in extended permit object-group DMZservices object TrustedUsers host 
access-list Outside_access_in extended permit tcp object UntrustedUsers host eq www 
access-list InsideNet standard permit 
access-list DMZ_access_in extended permit icmp any any object-group ICMPALL 
access-list global_access extended permit icmp any any object-group ICMPALL 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu DMZ 1500
mtu Outside 1500
mtu management 1500
ip local pool VPNpool mask
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit inside
icmp permit inside
icmp permit host inside
icmp permit DMZ
icmp permit DMZ
no asdm history enable
arp timeout 14400
nat (inside,Outside) source static InsideNetwork InsideNetwork destination static InsideNetwork InsideNetwork
object network DMZtoOUT
 nat (DMZ,Outside) dynamic interface
object network DMZtoOUThttp
 nat (DMZ,Outside) static interface service tcp www www 
object network DMZtoOUTftp
 nat (DMZ,Outside) static interface service tcp ftp ftp 
object network INtoOUT
 nat (inside,Outside) dynamic interface
access-group DMZ_access_in in interface DMZ
access-group Outside_access_in in interface Outside
access-group global_access global
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server NewRad protocol radius
aaa-server NewRad (DMZ) host
 timeout 5
 key *****
 authentication-port 1812
 accounting-port 1813
http server enable
http inside
dhcpd address inside
dhcpd enable inside
dhcpd address Outside
dhcpd enable Outside
dhcpd address management
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 8, 2017 at 16:08

1 Answer 1


On your identity NAT (nonat) add "route-lookup" at the end of the command to bypass the behavior of using the XLATE for the egress interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.