ASA 5505 routing between inside and outside interfaces 1

[xylax]

I have a unique setup at a couple of our locations and a strange issue to go with it.

Computer => ASA 5505 => SLE VPN Router => Satellite ---> Internet

Since I'm using an ASA 5505 more as a router than a VPN client, I'm having difficulty getting the remote network to see the machine behind the ASA for administrative purposes. The SLE VPN router is taking care of the VPN instead of the ASA. It routes all traffic to the ASA without issues. The machine can connect to anything on the remote network. Also, the remote network can connect to the outside interface of the ASA but not the internal network of the ASA. Below is the configuration of the test ASA I'm working on. I believe it's a static/access-list issue but I'm not sure. Could someone help me out cuz I'm scratching my head on this one.
======================================================
======================================================
ASA Version 8.0(3)
!
hostname TestASA
domain-name mfaoil.com
enable password XXXX encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.1.15.105 255.255.255.248
!
interface Vlan2
nameif outside
security-level 0
ip address 10.1.15.98 255.255.255.252
!
interface Vlan3
shutdown
no forward interface Vlan1
nameif dmz
security-level 50
no ip address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd xxxx encrypted
boot system disk0:/asa803-k8.bin
ftp mode passive
dns server-group DefaultDNS
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip verify reverse-path interface inside
asdm image disk0:/asdm-603.bin
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 10.1.15.97 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa authentication secure-http-client
no snmp-server location
no snmp-server contact
snmp-server community default
snmp-server enable traps snmp authentication linkup linkdown coldstart
client-update enable
console timeout 0
management-access inside
dhcpd lease 86400
dhcpd ping_timeout 750
dhcpd domain mfaoil.com
dhcpd auto_config outside
!
dhcpd address 10.x.x.x-10.x.x.x inside
dhcpd dns 10.x.x.x 10.x.x.x interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect http
!
service-policy global_policy global




Shon
Network Administrator

 

[North323]

you dont have any access lists. by default, its deny deny

 

[xylax]

Like this?

access-list outside_access_in permit ip 10.1.15.96 255.255.255.252 10.1.15.96 255.255.255.248

access-group outside_access_in in interface inside





Shon
Network Administrator

 

[North323]

yes like that. traffic will hit one interface, decide if traffic is permitted or denied then move to next interface and decide if traffic is allowed or denied. thats why you have to put acls on each interface (for the most part)

 

[xylax]

What would be the correct ACL to write to allow the outside interface to connect to the inside interface?

Shon
Network Administrator

 

[North323]

the outside interface will route to the inside interface by default. its the access list on the inside interface that matters, just like the example you provided above....do that same thing