Solved

Issues Configuring ASA5505 with 8.3

Posted on 2010-11-30
8
384 Views
Last Modified: 2012-08-14
All,

I have got an issue with a new Cisco ASA5505 that has come with version 8.3.

It is completely different and I am having issues with it.

Basically my issue at the moment is with NAT's and access to internal resources to translated addresses from External Sources.

Basically I have setup a Citrix Web Interface and I want to access this from remote sources (which I do with all my other sites with Cisco ASA but using 8.2),

So I have sort of worked out you put the translation on the object rather then creating a NAT rule, and I have confirmed this doing a www.whatismyip.com on the server in question.

I have the following bits of config which relate to this setup :

object network citrix
 host 192.168.108.14
object network citrix-ext
 host 18.141.70.14

object network citrix
 nat (any,any) static citrix-ext

access-list outside_access_in extended permit tcp any object citrix eq www

Which is what I normally do but it doesnt work, can anyone help?

Thanks

Paul
0
Comment
Question by:essexboy80
  • 3
  • 3
8 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 34239325
Your access-list should reference the external IP address:

access-list outside_access_in extended permit tcp any object citrix-ext eq www
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34239720
Are you sure, doesnt make any difference, I know pre 8.3 it was external but i read something that said use the non-translated address in your access rules with 8.3 and above
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 34240000
Ahh, yeah, I think I read that also.

Did you apply the access-list to the outside interface?

access-group outside_access_in in interface outside

Can you connect to 192.168.108.14 on port 80 from the inside network?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 17

Expert Comment

by:StrifeJester
ID: 34240751
What other ACLs are running you may also have to allow the traffic outgoing from the internal interface.  I know the way I have my ASA setup I block everything except the NAT traffic so I have to create outgoing rules on my internal interface because the traffic is translated static instead of via the NAT rule.  Not sure if there is something like this they have changed in 8.3.  So you have to create the translation, allow incoming on the outside interface and also all outgoing on the inside interface.
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34482839
AStill having issues
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 34483263
You applied the access-list to the outside interface, right?

access-group outside_access_in in interface outside
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34887310
all sorted thanks
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now