PTS上配置防火墙PAT，包无法返回

old73

Ping 防火墙外的路由器地址，包能到达目的路由器，但返回的时候，到防火墙就找到到返回的地址了。

interface Vlan1

nameif inside

security-level 100

ip address 172.16.20.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 61.128.128.60 255.255.255.0

!

interface Vlan10

no nameif

no security-level

no ip address

!

object network in_out

subnet 0.0.0.0 0.0.0.0

!

!

!

!

object network in_out

nat (inside,outside) dynamic interface

!

添加路由后，也是一样，包返回到防火墙后，找不到内网的地址

Version:1.0StartHTML:0000000105EndHTML:0000003987StartFragment:0000000538EndFragment:0000003951

interface Vlan1

nameif inside

security-level 100

ip address 172.16.20.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 61.128.128.60 255.255.255.0

!

interface Vlan10

no nameif

no security-level

no ip address

!

object network in_out

subnet 0.0.0.0 0.0.0.0

!

route outside 0.0.0.0 0.0.0.0 61.128.128.61 1

route inside 172.16.20.0 255.255.255.0 172.16.20.2 1

!

!

!

object network in_out

nat (inside,outside) dynamic interface

old73

解决了

加上:
access list 1 permit 1 icmp any any
access group 1 out interface inside

加上这两句就行了。
但原因是什么？防火墙在没有配置acl的情况下，为什么要阻止icmp在接口上out?但在in方向上不阻止？

Rockyw

感谢楼主分享！