2 subnets behind 1 interface of ASA 5505

[bioffice]

Hi,

I have an OpenVPN server in LAN subnet.
In gateway the tcp port is simple forwarded to the server.
Let's say, I have the following subnets:
- LAN - 192.168.1.0 / 24
- OpenVPN - 192.168.9.0 / 24
Open VPN server has 192.168.1.16 eth0, and 192.168.9.1 tap0.
Via OpenVPN I want to access the entire LAN subnet.

Using a C1812 it was easy, just an ip route command, telling who is the router for subnet.
ip route 192.168.9.0 255.255.255.0 192.168.1.16
In this way the communication is OK to and from OpenVPN network.

Using ASA5505 - on other site - I can't solve it.
I have:
route inside 192.168.9.0 255.255.255.0 192.168.1.16 1
nat (inside) 0 access-list nat0_outbound
access-list nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.9.0 255.255.255.0
access-list nat0_outbound extended permit ip 192.168.9.0 255.255.255.0 192.168.1.0 255.255.255.0
icmp permit 192.168.9.0 255.255.255.0 inside

In this way connected to OpenVPN
- I have full access to 192.168.1.16 - OpenVPN server
- I can ping the ASA - 192.168.1.253

But I can't access other server on LAN.
I get:
192.168.1.181 192.168.9.193 Deny TCP (no connection) from 192.168.1.181/22 to 192.168.9.193/36846 flags SYN ACK on interface inside

Any comment would be appreciated

 

[unclerico]

you should post this in the Cisco ASA forum.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[brianinms]

Try adding : same-security-traffic permit intra-interface

To the asa

 

[bioffice]

I have already

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

 

[burtsbees]

http://www.tek-tips.com/threadminder.cfm?pid=1598

/

Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25c), RELEASE SOFTWARE (fc2)
Technical Support:

http://www.cisco.com/techsupport

Copyright (c) 1523-2010 by Cisco Systems, Inc.
Compiled Thu 11-Feb-1539 23:02 by ßµ®†Šß€€Š

ROM: System Bootstrap, Version 12.2(7r) [ÝØÝØMØÑ], RELEASE SOFTWARE (fc1)

Edge uptime is 469¼

 

[burtsbees]

Can you ping the server instead of trying to ssh to it?

/

Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25c), RELEASE SOFTWARE (fc2)
Technical Support:

http://www.cisco.com/techsupport

Copyright (c) 1523-2010 by Cisco Systems, Inc.
Compiled Thu 11-Feb-1539 23:02 by ßµ®†Šß€€Š

ROM: System Bootstrap, Version 12.2(7r) [ÝØÝØMØÑ], RELEASE SOFTWARE (fc1)

Edge uptime is 469¼