Example configure 192.168.1.x to connect to management interface and configure another subnet 192.168.3.x for your server communication to dmz server. Therefore, Connect management interface through subnet which is not allowed to go out through Inside interface. In your case you are connecting to two different interfaces(management and inside) from the same subnet so ASA gets confused everytime ASA has to send a reply packets.

Also you need to restrict the subnet to enter or connect to asa through only one interface(or else it would create asymetric routing). In that case you need to restrict the subnet which could have the management interface access.

ASA itself identifies that as connected route. You do not need to explicitly configure a route for directly connected subnet. You need to have a route on ASA for subnet 172.16.x.x subnet through management interface for return traffic as gateway pointing towards 元 switch 192.168.1.3 IP(then again check that the route is not present through inside interface also or else again it would create asymetric routing). I believe this 172 subnet is not configured on ASA interfaces. However you realy wish to make it work(it is a asymetric routing scenario) then you could try implementing TCP statebypass(usually not recommanded).Ĭase 2: Your 元 switch would perform Intervlan routing for your management subnet and 172.16.x.x subnet. So they would not be able to communicate. As interface inside of connection doesn't match with route management, ASA would drop the connection. ASA now would compare the Connection created and the route on ASA. Both of your servers would be able to communicate with your DMZ servers.Ĭase 1 : Return traffic would not be routed through Inside Interface as the Mgmt interface is configured with 192.168.1.x subnet.

Free online word jumble game