Basic conf CISCO ASA 5505

Hello,

I'm a newbie on ASA, I need some assistance.

I have this schema.

Host 192.168.1.0/ ---> ASA INSIDE

---

>ASA OUTSIDE

---

> to my interface router

From host 192.168.1.0/24 I can ping INSIDE interface from my ASA but I cannot ping interface OUTISIDE and no interface from my router at this address 172.16.0.5/252

Under my conf.

ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 1I5BT/dHhpGbnQvr encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 100
ip address 172.16.0.6 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip any any
access-list outside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
nat-control
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 172.16.0.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd enable inside
!

username admin password p1ClWSkbSujddlxc encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:885202205e413b4a47e7f59d572ef3d7
: end

same security level interfaces cannot talk to each other.

pixel,

Although you have both inside and outside interfaces using the same security level 100 (which is NOT the recommended setup). The command same-security-traffic permit inter-interface in your config permits traffic to flow between the two interfaces. So this shouldn't be a problem.

For pinging the router interface from the host. Make sure you have a route in your router's routing table that points to the 192.168.1.0/24 network. Otherwise the ping replies from the router will be dropped by the router it self. You can achieve this for example by using a static route (on your router):

[code:1]Router(Config)# ip route 192.168.1.0 255.255.255.0 172.16.0.6[/code:1]

For pinging your outside ASA interface from the host, it seams that the ASA won't allow this. The ASA by default, simply does not respond to pings that cross different interfaces. Why? I don't know, and I don't know how to solve it either . Check here: www.cisco.com/en/US/products/hw/vpndevc/...186a0080094e8a.shtml