ASA8.03 NAT Problem

Unanswered Question
Nov 21st, 2007
User Badges:

Hi !


I have a problem with my ftp server in the DMZ. I am not able to reach it from the internet. I have tried many different nat rules and acces list, but can't get it to run. When I do a paket trace with the adsm, it say that everything is fine - but still no contact. What am I doing wrong?


Here comes the config:


ASA Version 8.0(3)

!


names

!

interface Ethernet0/0

nameif Outside

security-level 0

ip address 62.x.x.76 255.255.255.248

!

interface Ethernet0/1

nameif Inside

security-level 100

ip address 192.168.100.1 255.255.255.0

!

interface Ethernet0/2

nameif DMZ

security-level 50

ip address 192.168.110.1 255.255.255.0

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!


boot system disk0:/asa803-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

access-list Outside_access_in extended permit tcp any eq ftp host 62.206.196.77

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu DMZ 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-603.bin

no asdm history enable

arp timeout 14400

global (Outside) 101 interface

global (DMZ) 101 interface

nat (Inside) 101 0.0.0.0 0.0.0.0

nat (DMZ) 101 192.168.110.0 255.255.255.0

static (DMZ,Outside) 62.x.x.77 192.168.110.10 netmask 255.255.255.255

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 62.206.196.73 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 192.168.100.0 255.255.255.0 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

no threat-detection basic-threat

threat-detection statistics access-list

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:xxx

: end

asdm image disk0:/asdm-603.bin

no asdm history enable


Any help is greatly appreciated. Thank you!


best regards


Fritjof

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
JORGE RODRIGUEZ Wed, 11/21/2007 - 14:30
User Badges:
  • Green, 3000 points or more

try changing your static nat as :


no static (DMZ,Outside) 62.206.196.77 192.168.110.10 netmask 255.255.255.255

static (DMZ,Outside) tcp 62.206.196.77 21 192.168.1.10 21 netmask 255.255.255.255




[edit] in case inbound does not hit the ftp server change acl as:


access-list Outside_access_in permit tcp any 62.206.196.77 eq 21

access-group Outside_access_in in interface outside



HTH

Jorge

Actions

This Discussion