yeah, its a private ip.

sample:

pc = 192.168.1.10

nat (inside) 1 access-list 101

nat (inside) 0 access-list 101 --for my existing vpn link

global (outside) 1 interface

access-list 101 permit ip host 192.168.1.0 any

access-list 102 permit ip host 192.168.1.0 any

access-group 102 in interface inside

right?

thanks

robert

Robert

nat (inside) 0 access-list 101

nat (inside) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface

Your access-list stuff is fine.

HTH

Jon

Hi Jon, im very thankful for your help but it doesn't work.

maybe its connected to the firmware? cause when i upgrade it to asa722-14-k8.bin from asa722-10-k8.bin, thats the internet was gone. The one that you suggest was really my config on asa722-10k8 firmware and its working fine but things change when i upgrade to 722-14...any more ideas?

thanks

robert

Hi Robert

Could you send me a copy of the config you are working with minus any sensitive information.

Jon

Here's my sample config...

thanks

robert

Robert

There are a few questions from your config.

1) access-list 111 permit ip host x.x.x.x host 172.1.1.2

This is the outside interface of your pix. What is the reason for this

access-list, what are you trying to achieve with it.

2) nat (inside) 0 access-list 101

This is saying anything from 192.168.10.0/24 shoud not be natted. These addresses

are not routable so if they do go out onto the Internet they won't route back.

Could you tell me

3) Is the outside interface of the pix your connection to the internet.

4) Do you want to stop all the 192.168.10.0/24 network from accessing the internet except one particular host.

Jon

1) access-list 111 permit ip host x.x.x.x host 172.1.1.2

-there is an existing vpn connection to this so I allow only the other's side ip...this should not be affected...

2) nat (inside) 0 access-list 101

-yup, i want the whole 192.168.10.0 network to be like this cause of the existing...for security...

3) Is the outside interface of the pix your connection to the internet.

-yup, e0/0 is directly connected to the isp, outside to internet...

4) Do you want to stop all the 192.168.10.0/24 network from accessing the internet except one particular host

-that is exactly what I want to do..allow only one pc to the internet...

thanks

robert

Robert

Asssuming the host is 192.168.10.25

access-list hostonly permit ip host 192.168.10.25 any

nat (inside) 1 access-list hostonly

global (outside) 1 interface

This will NAT only the 192.168.10.25 host to the public IP address on the outside interface of your pix.

HTH

Jon

Hi Jon,

sorry to tell but still not working.

maybe its the firmware? cause it happens when I upgrade the firmware to asa722-14-k8 from asa722-10-k8.

thanks,

robert