从内部到内部的流量被丢弃

Question

ASA 5505被用来在两个网络之间进行路由，因为它包含到任何东西的路由。下面描述网络拓扑结构。

我尝试过各种访问列表组合，例如：

access-list INSIDE_TO_INSIDE extended permit ip any any

或

access-list INSIDE_TO_INSIDE extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0

以及：

 access-group INSIDE_TO_INSIDE in interface inside

我不能从.30网络的PC机连接到.10网络上的PC机。

我的日志里有这样的东西：

    iscoasa# %ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-3-106014: Deny inbound icmp src inside:192.168.10.117 dst inside:192.168.30.11 (type 0, code 0)
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-3-106014: Deny inbound icmp src inside:192.168.10.117 dst inside:192.168.30.11 (type 0, code 0)
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64338 flags RST ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64339 flags RST ACK  on interface inside
%ASA-3-106014: Deny inbound icmp src inside:192.168.10.117 dst inside:192.168.30.11 (type 0, code 0)
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/22 to 192.168.30.11/64337 flags SYN ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64338 flags RST ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64339 flags RST ACK  on interface inside
%ASA-3-106014: Deny inbound icmp src inside:192.168.10.117 dst inside:192.168.30.11 (type 0, code 0)
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/21 to 192.168.30.11/64340 flags RST ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64338 flags RST ACK  on interface inside
%ASA-2-106001: Inbound TCP connection denied from 192.168.10.117/80 to 192.168.30.11/64339 flags RST ACK  on interface inside

这是一个漂亮的股票ASA配置。此外，数据包跟踪器显示icmp或tcp 22通信量，这是从192.168.30.11到192.168.10.117之间的隐式规则丢弃的。怎么回事？

Answer 1

您要查找的命令是same-security-traffic permit {inter-interface | intra-interface}。

默认情况下，输入一个接口的通信量不能退出同一个接口。下面的命令将允许此通信量。

same-security-traffic permit intra-interface

通常与此命令相关的是same-security-traffic permit inter-interface命令。默认情况下，ASA不允许来自一个安全级别的通信退出同一安全级别的接口。same-security-traffic permit inter-interface命令允许这种通信量。

有关详细信息，请参阅本Cisco文档。

https://www.cisco.com/c/en/us/td/docs/security/asa/asa81/command/ref/refgd/s1.html