I made these changes but pings still fail and no access to device at 192.168.1.3 :-(
Main Topics
Browse All TopicsI am using AT&T DSL business service and have a block of IP addresses assigned. The default gateway is aaa.bbb.ccc.33. The aaa.bbb.ccc.34 IP is assigned to the ASA. I'd like to use the aaa.bbb.ccc.35 IP and create a static NAT to translate to the 192.168.1.3 private address.
I have several issues with the configuration of the ASA.
1) I cannot ping the .34 or .35 IP address from the outside
2) I don't think the NAT between .35 and private address 192.168.1.3 is working
3) I cannot connect to the ASA via ASDM or SSH from the outside. I can connect fine from the inside via HTTPS.
Below is my running config.
Please help!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Ok you static is good but your ACL is not right.
You have:
access-list outside_access_in extended permit icmp any any
access-list outside_access_in remark smtp for small business server
access-list outside_access_in extended permit tcp any host 192.168.1.3 eq smtp
access-list outside_access_in remark http for small business server
access-list outside_access_in extended permit tcp any host 192.168.1.3 eq www
access-list outside_access_in remark https for small business server
access-list outside_access_in extended permit tcp any host 192.168.1.3 eq https
You need to change the 192.168.1.3 to aaa.bbb.ccc.35 in that access-list.
So make sure you re-apply the acl once you fix it.
So I am assuming you are making changes to the ASA either through a telnet or ssh session on the inside interface or you are consoled in. How are you testing the asdm and ssh from the outside? IF you are on the inside and are trying to access the outside interface for ssh or asdm thats not gonna work, you would actually have to be on the outside. Is that how you are testing this. You config looks good, assuming your myip2 is correct on the ssh entry.
It's actually through Kaseya. There is an software agent installed on the server at 192.168.1.3. I have created a remote desktop connection through the agent on the server behind the firewall. I am effectively working on the console of the machine on the LAN. The wire protocol is some sort of tunnel through the Kaseya agent.
Ok I was just trying to make sure that the traffic from your box was not going in some round about way to get there. The config looks good. I don't see anything wrong with it unless you address is not what you think it is. Go to www.whatismyip.com and verify that the address you think you have is what is being reflected on the internet. However you did have a an all 0.0.0.0.0 for http so not sure why that is not working. Do you get anything on your browser when you attempt to connect? I have to shutdown here tonight but what I would do is once you are sure of your public ip address. keep issuing this command over and over while you try to connect:
sho log | include x.x.x.x
x.x.x.x = your public ip address.
The log keeps overwriting itself so you have to keep entering the command over and over. It will show you all entries that have your address in it. I would start there and see if the logs tell you anything.
Good luck.
Business Accounts
Answer for Membership
by: kenboonejrPosted on 2009-08-13 at 19:34:40ID: 25094882
You static statement is backwards
It should be
Make sure you delete the other command and then issue clear xlate command before adding this.
static (inside,outside) aaa.bbb.ccc.35 192.168.1.3 netmaskk 255.255.255.255
Then you need to re-do the acl that allows access to this box. So everywhere you defined 192.168.1.3 should be aaa.bbb.ccc.35.
Also get rid of the acl called inside_access_in
It is not needed.
That will resolve part of your problem.
Did you issue the command "crypto key generate rsa modulus 1024" to create the key needed for ssh?