Firewall – cisco firewall access rules for intra-subnet traffic

ciscocisco-asafirewallsubnet

I have a Cisco 5505 in our office, and everything is on the 10.0.1.0 network. We have a cheap wireless router that we would like to use. The router is sitting behind the inside interface, and is configured to have 10.0.2.0 behind it, and has the ip address 10.0.1.175 for the interface facing our firewall. I have added a static route as so:

route inside 10.0.2.0 255.255.255.0 10.0.1.175 1

I have also added this access rule:

access-list inside_access_in extended permit tcp 10.0.2.0 255.255.255.0 any

However, when I try to, say, remote desktop to a machine behind this router, I get this message in the logs:

Inbound TCP connection denied from 10.0.1.46/53484 to 10.0.2.3/3389 flags SYN on interface inside

I'm not terribly experienced with this, so any help would be gratefully appreciated.

Best Answer

It turns out I needed the following command:

same-security-traffic permit intra-interface