Ivan

" it is mandatory to have a static translation when coming from a lower security interface (dmz 20) to a higher security interface (inside 100)"

Not sure it is. I have configured the following many times

nat (outside) 1 192.168.5.0 255.255.255.0 outside

global (inside) 1 172.10.1.1

where all source addresses of 192.168.5.x coming in from the outside will be translated to 172.10.1.1.

Is this not a supported configuration ?

Jon

Ivan,

I thought the same, then I did the static translation and it still didnt work.

And anyway , if I have 100 servers and 30 networks to access I have to do all those statics.

Sounds a bit absurd.

I was checking some documents on cisco, and there was mentioned that this configuration should work.

It definately works with ASA.

Thanks,

Vlad

Anyway ,

the keyword outside at the end allows the traffic from lower sec to higher security.

My problem is that I get" No transaltion group found "

Vlad

Vlad

The only difference between your config and the one i have used many times before is the fact that your lower security interface is the DMZ interface and not the outside interface but looking at the command reference for 6.3 it only talks about lower to higher and having to use the "outside" keyword ie. it doesn't say it has to be specifically the outside interface.

Unfortunately i don't have a pix to test with so am of limited help but as previously discussed i know this works outside -> inside.

Jon

Jon,

It definetly works with 7.0, but it says it was introduced with 6.2 so it should work with mine as well.

I dont really understand why ...? Could it be a bug in the IOS ...is there anybody aware of this?

A bit of help here people,c'mon!

Thanks

Vlad

Jon,

Does the interface name have to be outside...I mean I dont think so, sounds a bit ...

I suppose it reffers to traffic from lower to higher ...not specifically outside---> inside.

Thanks for your help!

Vlad

Vlad

"Does the interface name have to be outside" - well that's what i have done before but as i say the command reference for 6.3 suggests it just has to be a lower security interface. Could you run a quick test with outside or is this not possible ?

I can guarantee it works on 6.x because that was the version of code i used this configuration on.

Jon

Jon,

This is a test fw , so yes I will try with the outside interface tomorrow and let you know the result ,but if this would be succesful then where is the point of having this feature if it does not work with the rest of the interfaces as well?

Vlad

Vlad

Okay, let me know what happens.

"but if this would be succesful then where is the point of having this feature if it does not work with the rest of the interfaces as well?"

Can't answer that unfortunately - leave that one to Cisco i think :-)

Jon

Jon,

Just did this and guess what : " NO translation group found".

This is the config :

ccess-list acl-in permit ip any any

access-list acl-in permit icmp any any

access-list out permit ip any any

access-list out permit icmp any any

pager lines 24

logging on

logging standby

logging monitor informational

logging buffered informational

mtu outside 1500

mtu inside 1500

ip address outside 192.168.4.1 255.255.255.0

ip address inside 10.10.10.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (inside) 1 interface

nat (outside) 1 192.168.4.0 255.255.255.0 outside 0 0

access-group out in interface outside

access-group acl-in in interface inside

Thanks,

Vlad

Vlad

Do you have a hammer you could use on the pix ...

Just found this bug -

CSCee85940 Bug Details Bug #18 of 289 | < Previous | Next >

outside nat not working

Symptom: "outside nat" configured using nat and global statements is not working.

Conditions: When traffic is initiated from low security interface side, source nating or bidirectional nating

Workaround: Use static nat for source nat or bidirectional nat

Now it says it's fixed in 6.3(4) but at the same time it says it is first found in 6.3(4). Any chance you could ugrade to 6.3(5) and retest ?

Jon

Jon,

I thought about a bug also and the confiuration pasted here is from a 6.3(5) and it does not work.

So , I think the hammer is the ultimate solution in solving this.

Thanks,

Vlad

TNT would be more fun. I don't see why ANYONE would buy an ASA. What a POS. Object tracking blows, Nat0 BS blows. No route map capability and it is F*ing SLOOOOOW. Get a router - you cant lose!