Solved

Issues Configuring ASA5505 with 8.3

Posted on 2010-11-30
8
385 Views
Last Modified: 2012-08-14
All,

I have got an issue with a new Cisco ASA5505 that has come with version 8.3.

It is completely different and I am having issues with it.

Basically my issue at the moment is with NAT's and access to internal resources to translated addresses from External Sources.

Basically I have setup a Citrix Web Interface and I want to access this from remote sources (which I do with all my other sites with Cisco ASA but using 8.2),

So I have sort of worked out you put the translation on the object rather then creating a NAT rule, and I have confirmed this doing a www.whatismyip.com on the server in question.

I have the following bits of config which relate to this setup :

object network citrix
 host 192.168.108.14
object network citrix-ext
 host 18.141.70.14

object network citrix
 nat (any,any) static citrix-ext

access-list outside_access_in extended permit tcp any object citrix eq www

Which is what I normally do but it doesnt work, can anyone help?

Thanks

Paul
0
Comment
Question by:essexboy80
  • 3
  • 3
8 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 34239325
Your access-list should reference the external IP address:

access-list outside_access_in extended permit tcp any object citrix-ext eq www
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34239720
Are you sure, doesnt make any difference, I know pre 8.3 it was external but i read something that said use the non-translated address in your access rules with 8.3 and above
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 34240000
Ahh, yeah, I think I read that also.

Did you apply the access-list to the outside interface?

access-group outside_access_in in interface outside

Can you connect to 192.168.108.14 on port 80 from the inside network?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 17

Expert Comment

by:StrifeJester
ID: 34240751
What other ACLs are running you may also have to allow the traffic outgoing from the internal interface.  I know the way I have my ASA setup I block everything except the NAT traffic so I have to create outgoing rules on my internal interface because the traffic is translated static instead of via the NAT rule.  Not sure if there is something like this they have changed in 8.3.  So you have to create the translation, allow incoming on the outside interface and also all outgoing on the inside interface.
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34482839
AStill having issues
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 34483263
You applied the access-list to the outside interface, right?

access-group outside_access_in in interface outside
0
 
LVL 1

Author Comment

by:essexboy80
ID: 34887310
all sorted thanks
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco NBAR 6 31
Access List 4 31
Where do I upload the internet on a cisco catalyst 2960 poe 7 36
Cisco ASA 5505 Login issues 2 18
If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now