Member Avatar for c-tech

Hi guys,
I have a CISCO 5500 Firewall and it already has 2 networks connected: one connecting to the internet and the other one connecting my private network.
I have now connected another network on one of the interfaces but I am unable to enable communication between the new network and the existing private network. I have tried following Cisco instructions on how to allow inter-interface traffic but so far I have been unsuccessful. Is it to do with NAT-ing or something? Kindly assist.

  • 2 Contributors
  • 2 Replies
  • 240 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by jlego

Dani AI

Generated

Short summary and checklist tied to the thread: common reasons an ASA 55xx refuses to pass traffic between two connected networks are (1) interface security-levels or “same-security” rules, (2) missing routes or wrong host gateways, (3) access-lists blocking the flow, and (4) NAT translating addresses when you expected identity (no-translation). ’s follow-up shows the problem is solvable by addressing translation rules; ’s comment about exempt/identity NAT is on the right track. The short checklist below helps find and fix the root cause quickly.

Quick checklist and commands to run first (from the ASA CLI):

show nameif
show interface ip brief
show route
show access-list
show nat detail
show xlate
packet-tracer input <ingress-if> tcp <src-ip> <src-port> <dst-ip> <dst-port>

If two interfaces share the same security level (or traffic must enter and exit the same interface), the ASA blocks that by default; enable it explicitly with same-security-traffic permit inter-interface or same-security-traffic permit intra-interface. (cisco.com)

NAT notes and minimal examples (two common ASA models):

  • Pre-8.3 (old syntax): use a NAT-exempt ACL (nat 0) to avoid translating traffic between internal subnets.

    access-list NO_NAT extended permit ip 192.168.10.0 255.255.255.0 10.10.20.0 255.255.255.0
    nat (inside) 0 access-list NO_NAT

  • ASA 8.3+ (new NAT model): use identity / twice-NAT (define network objects then map them to themselves for the specific source/destination pair).

    object network LAN_A
    subnet 192.168.10.0 255.255.255.0
    object network LAN_B
    subnet 10.10.20.0 255.255.255.0
    nat (inside,dmz) source static LAN_A LAN_A destination static LAN_B LAN_B

See Cisco docs for the older nat 0 exempt method and the newer twice/identity NAT model. (cisco.com)

Troubleshooting tips: use packet-tracer to see which NAT/ACL/rule the ASA applies; check show nat detail and translate_hits to confirm which rule matched; remember manual NAT rule order can override more specific entries, so reorder if needed. If traffic still drops, verify host default gateways and run packet captures on the ASA interface to confirm where packets stop. (cisco.com)

Member Avatar for c-tech

I was able to sort out this problem (albeit after much struggle :( ) by adding a dynamic translation(PAT) for traffic from my 'old' private network to an IP on the new network. I am now able to reach hosts on the new network from the 'old' network.
Hope this is of help to someone else.

Member Avatar for jlego

Glad you figured it out,
was going to say you need to allow a dynamic any on the inside translated to the outside mark sure that all you networks have exempt nats as well

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.