0

I have a recently-purchased cisco rv220w wireless router. My setup is as follows:

Internet -> asa 5505 -> 10.0.1.0 subnet -> wireless router

(subnet 10.0.3.0, public facing ip is 10.0.1.140).

I can ping between the two subnets fine, but not much else. I did a packet capture with wireshark and noticed something really interesting. If I try to connect from a machine from the 10.0.1.0 subnet to the 10.0.3.0 subnet, say remote desktop for this example, I get a SYN, then a SYN_ACK, and then not ACK back. Only a reset (RST) is getting sent from the machine initiating the connection.

This is super weird. Any help would please be appreciated. I have the detailed captures if necessary. Also, here is packet-trace result of say.. a computer on the 10.0.1.0 subnet trying to remote into a computer in the 10.0.3.0 subnet:

packet-tracer input inside tcp 10.0.1.46 33000 10.0.3.151 3389

Phase: 1
Type: FLOW-LOOKUP`
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.0.3.0        255.255.255.0   inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
object-group service DM_INLINE_TCP_1 tcp
 group-object ftpdatatls
 group-object ftptls
 group-object gtalk
 group-object imapssl
 group-object smtp2
 group-object smtpssl
 group-object sqlserver
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https
 port-object eq imap4
 port-object eq pop3
 port-object eq smtp
 port-object eq ssh
 port-object eq telnet
 group-object internetradio
 port-object eq whois
 group-object webmail
 group-object rdp
 group-object mtbogcweb
 group-object git
 group-object iCloudSMTP
 group-object whm
 group-object utahsde
 port-object eq 1401
 port-object eq 5442
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type:
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
  match ip inside 10.0.1.0 255.255.255.0 inside 10.0.3.0 255.255.255.0
    NAT exempt
    translate_hits = 23, untranslate_hits = 0
Additional Information:

Phase: 7
Type: NAT-EXEMPT
Subtype: rpf-check
Result: ALLOW
Config:
  match ip inside 10.0.3.0 255.255.255.0 inside 10.0.1.0 255.255.255.0
    NAT exempt
    translate_hits = 0, untranslate_hits = 23
Additional Information:

Phase: 8
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 9
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 10
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 11
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 77684, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
Improve this question

2 Answers 2

Reset to default
0

If I understood correctly, your complete setup is:

Internet -> asa 5505 -> 10.0.1.0 subnet -> wireless router -> 10.0.3.0 subnet

Since wireless router is new, I'm guessing that all PC in 10.0.1.0 subnet are using asa 5505 as default gateway. As a result, packets coming from 10.0.1.0 to 10.0.3.0 are translated to pool 1, which somehow messing the packet flow.

Try to: 1. Change default gateway for all PC in 10.0.1.0 subnet to wireless router, or 2. disable nating to pool 1

Improve this answer
4
  • That is correct. How do I disable nating to pool 1? Is it: no nat (inside) 1 0.0.0.0 0.0.0.0 ? That would disable any outside internet access inside the 10.0.1.0 subnet though.
    – sovemp
    Apr 23, 2014 at 20:26
  • Try this: access-list NAT_EXEMPT extended permit ip 10.0.1.0 255.255.255.0 10.0.3.0.0 255.255.255.0 <br/> nat (inside) 1 access-list NAT_EXEMPT
    – Faiz R
    Apr 24, 2014 at 5:02
  • Do you mean "nat(inside) 0 access-list NAT_EXEMPT" ? That still isn't working, and with 1 as the pool number icmp traffic won't even pass.
    – sovemp
    Apr 24, 2014 at 15:56
  • Exactly, it should be nat (inside) 0, tried to edit but it was not possible. After you did this, what are the packet-trace result ? Did you try to change default gateway on one of PC in subnet 10.0.1.0 ?
    – Faiz R
    Apr 24, 2014 at 18:24
0

So, ultimately someone from reddit pointed me in the right direction. The solution that worked for me is here: https://serverfault.com/questions/511059/routing-via-cisco-asa-is-changing-tcp-sequence-ack-numbers.

It appears that the ASA was randomizing the sequence numbers, which was confusing the wireless router. Specifically, I added

set connection advanced-options tcp-state-bypass

to my global inspection policy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .