The flaw here is that your packets are not bi-directionally being passed through your ASA, so it never sees any TCP session come up as only one direction of traffic is passing through it.
If your source is 192.168.1.59, and you redirect the packet back to your LAN via 192.168.1.2, the router at 192.168.1.2 is going to be sending the reply packets directly to your servers being on the connected interface. It won't go back the way it came via the firewall as that wasn't the source. It may be best to force traffic to go completely through your firewall by connecting your 192.168.1.2 gateway directly to it via another physical port if you need this functionality. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Moerman, Maarten Sent: Wednesday, October 24, 2007 06:39 To: [email protected] Subject: [c-nsp] redirect nexthop on ASA 5510 Hi All, I'm having trouble configuring a ASA5510 to behave as a router that sets a "redirect next hop". I've configured the ASA perfectly, VPN is working, NAT is working, routing SEEMS to be working but does not work for stateful connections. I have: Internet -> Cisco 2600 public IP/something --> ASA55110 --> private lan with servers --> within there another gateway with a couple of subnets behind that, in which where my laptop resides for testing. I have setup the routes to that gateway: route inside 192.168.2.0 255.255.255.0 192.168.1.2 1 route inside 192.168.3.0 255.255.255.0 192.168.1.2 1 and have setup the correct nat exemption: nat (inside) 0 access-list inside_nat0_outbound access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0 Ping reply's do get along the cables, however, when setting up a RDP session, or a HTTP request, I get this in the log: Deny TCP (no connection) from 192.168.1.59/3389 to 192.168.2.92/3289 flags SYN ACK on interface inside Where 192.168.1.59 is the machine I'm RDP'ing to (or http), and 192.168.2.92 is my laptop. It cannot find a established session in the connection table, which off course makes sense cause I don't want to NAT that traffic. So how do I enable stateful connections.... Asa = 192.168.1.1 (inside) Other firewall (which perfectly routes, If I change machines to use that as default gateway) = 192.168.1.2 My laptop subnet = 192.168.2.0/24 ASA version = 8.0(2) ASDM version = 6.0(2) I've enable the "Enable traffic trough firewall without address translation" also. And I've enabled "Enable traffic between two or more hosts connected to the same interface" Anybody a clue? Thanks in advance, Maarten Moerman -- Network Engineer | eBay / Marktplaats.nl Randweg 25 | 8304 AS Emmeloord E-mail: [EMAIL PROTECTED] | Mobile: +31 6 55 1 222 47 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
