Cisco ASA 5505 ACL Problems

Answered Question
Jul 17th, 2007

I am going nuts trying to figure this one out. I'm new to the ASA, but I've worked with Pix firewalls for years. All I'm doing is some simple one-to-one NAT for HTTPS, SMTP and WWW for an exchange server.

I've got my static NATs:

static (inside,outside) tcp 67.52.38.94 smtp 10.0.0.11 smtp netmask 255.255.255.255

static (inside,outside) tcp 67.52.38.94 www 10.0.0.11 www netmask 255.255.255.255

static (inside,outside) tcp 67.52.38.94 https 10.0.0.11 https netmask 255.255.255.255

I've got my Outside access-list:

access-list outside_access_in extended permit tcp any host 67.52.38.94 eq https

access-list outside_access_in extended permit tcp any host 67.52.38.94 eq smtp

access-list outside_access_in extended permit tcp any host 67.52.38.94 eq www

access-group outside_access_in in interface outside

From what i can tell everything should work. However, syslog is telling me my test connections are being dropped by ACL. When I use the packet trace tool in the ASDM it tells me the explicit deny at the end of my ACL is the reason it is denying the traffic. The maddening thing is my previous ACL entries are matches so why would the implicit deny even be considered?

I'm wondering if this is an issue due to the fact that I have one public IP address to deal with here and it is in use as the outside address on the ASA. However, I've performed similar configs on a Pix with no issues. Finally, I have disabled the http server and SSL VPN to ensure there are no conflicts on ports 80 and 443 for the exchange server.

I have attached a sample config with some of the sensitive data scrubbed. I don't think I have omitted anything that would be affecting the ACL.

Please help - I'm going crazy here!

I have this problem too.
0 votes
Correct Answer by acomiskey about 9 years 6 months ago

Yeah, kinda silly, you have to use the keyword "interface" in your static when using outside interface ip.

static (inside,outside) tcp interface smtp 10.0.0.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.0.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.0.11 https netmask 255.255.255.255

I believe this only applies when overloading on outside interface like so...

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

Please rate helpful posts.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Correct Answer
acomiskey Tue, 07/17/2007 - 10:18

Yeah, kinda silly, you have to use the keyword "interface" in your static when using outside interface ip.

static (inside,outside) tcp interface smtp 10.0.0.11 smtp netmask 255.255.255.255

static (inside,outside) tcp interface www 10.0.0.11 www netmask 255.255.255.255

static (inside,outside) tcp interface https 10.0.0.11 https netmask 255.255.255.255

I believe this only applies when overloading on outside interface like so...

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

Please rate helpful posts.

s-mvasquez Thu, 08/23/2007 - 18:33

I was having the same issue and tried everything, except for assigning the actual Interface. I had tried the IP, but not the interface itself. I just figured that the outside interface IP was just to be used for management on the ASA and that I just had to use another public IP to forward traffic.

This is my 1st time with an ASA. I appreciate your help and guidance.

Miguel

Actions

This Discussion