Issues Configuring ASA5505 with 8.3

All,

I have got an issue with a new Cisco ASA5505 that has come with version 8.3.

It is completely different and I am having issues with it.

Basically my issue at the moment is with NAT's and access to internal resources to translated addresses from External Sources.

Basically I have setup a Citrix Web Interface and I want to access this from remote sources (which I do with all my other sites with Cisco ASA but using 8.2),

So I have sort of worked out you put the translation on the object rather then creating a NAT rule, and I have confirmed this doing a www.whatismyip.com on the server in question.

I have the following bits of config which relate to this setup :

object network citrix
 host 192.168.108.14
object network citrix-ext
 host 18.141.70.14

object network citrix
 nat (any,any) static citrix-ext

access-list outside_access_in extended permit tcp any object citrix eq www

Which is what I normally do but it doesnt work, can anyone help?

Thanks

Paul
LVL 1
essexboy80Asked:
Who is Participating?
 
JFrederick29Connect With a Mentor Commented:
You applied the access-list to the outside interface, right?

access-group outside_access_in in interface outside
0
 
JFrederick29Commented:
Your access-list should reference the external IP address:

access-list outside_access_in extended permit tcp any object citrix-ext eq www
0
 
essexboy80Author Commented:
Are you sure, doesnt make any difference, I know pre 8.3 it was external but i read something that said use the non-translated address in your access rules with 8.3 and above
0
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

 
JFrederick29Commented:
Ahh, yeah, I think I read that also.

Did you apply the access-list to the outside interface?

access-group outside_access_in in interface outside

Can you connect to 192.168.108.14 on port 80 from the inside network?
0
 
Justin EllenbeckerIT DirectorCommented:
What other ACLs are running you may also have to allow the traffic outgoing from the internal interface.  I know the way I have my ASA setup I block everything except the NAT traffic so I have to create outgoing rules on my internal interface because the traffic is translated static instead of via the NAT rule.  Not sure if there is something like this they have changed in 8.3.  So you have to create the translation, allow incoming on the outside interface and also all outgoing on the inside interface.
0
 
essexboy80Author Commented:
AStill having issues
0
 
essexboy80Author Commented:
all sorted thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.