Pity.
I tried the config you reported and I'm getting a bit crazy.
I've an ASA 5505 conected to an access-router C837 that gives to me Internet access through Dynamic IP from my ISP.
This is the config of the ASA
This is the same case the original request
Except there's first an access router, then ASA then internally a Catalyst switch
I've got internal FTP access but not from outside (from internet)
ASA Version 7.2(2)
!
hostname ASA5505
domain-name UScore.local
enable password
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.240
!
interface Vlan2
nameif outside
security-level 0
ip address 10.10.10.2 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
!
passwd
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name UScore.local
access-list 133 extended permit tcp any interface outside eq ftp-data <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
access-list 133 extended permit tcp any interface outside eq ftp <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
access-list 133 extended permit udp host 10.10.10.1 eq syslog host 192.168.1.3 eq syslog log notifications
access-list 133 extended permit ip 192.168.1.0 255.255.255.240 any log
pager lines 24
logging timestamp
logging console notifications
logging monitor notifications
logging trap notifications
logging asdm informational
logging mail debugging
logging device-id hostname
logging host inside 192.168.1.3
logging debug-trace
logging class auth mail emergencies
mtu inside 1576
mtu outside 1576
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ip audit name BASIC info action reset
ip audit name ATTACK attack action drop
ip audit attack action alarm reset
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
asdm history enable
arp inside 192.168.1.3 0013.8fc6.1ef8
arp inside 192.168.1.1 0016.ec48.4a16
arp inside 192.168.1.10 0002.b386.94b5
arp inside 192.168.1.9 0011.93e4.15c0
arp timeout 3600
global (outside) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.240
static (inside,outside) tcp interface ftp 192.168.1.1 ftp netmask 255.255.255.255 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
static (inside,outside) tcp interface ftp-data 192.168.1.1 ftp-data netmask 255.255.255.255 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<
access-group 133 in interface outside <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
route outside 0.0.0.0 0.0.0.0 10.10.10.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
username
username
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.240 inside
no service password-recovery
service resetinbound
service resetoutside
telnet 192.168.1.3 255.255.255.255 inside
telnet timeout 3
ssh 192.168.1.3 255.255.255.255 inside
ssh timeout 10
ssh version 2
console timeout 0
management-access inside
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
tftp-server inside 192.168.1.1 \TFTP
csd image disk0:/securedesktop-asa-3.1.1.29-k9.pkg
csd enable
prompt hostname context
Cryptochecksum:c76893628ecc39821d3d379f4c7b978b
: end
So it seems to be all right
But it doesn't work
Ok I give you either my C837 config
C837#sh run
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
service sequence-numbers
!
hostname C837
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
security passwords min-length 6
logging buffered notifications
logging console notifications
logging monitor notifications
enable secret
enable password
!
aaa new-model
!
!
aaa authentication login local_auth local
!
aaa session-id common
no ip source-route
no ip gratuitous-arps
!
!
ip dhcp excluded-address 10.10.10.1
!
!
ip cef
ip domain name soyuz.local
no ip bootp server
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name autosec_inspect cuseeme timeout 3600
ip inspect name autosec_inspect ftp timeout 3600
ip inspect name autosec_inspect http timeout 3600
ip inspect name autosec_inspect rcmd timeout 3600
ip inspect name autosec_inspect realaudio timeout 3600
ip inspect name autosec_inspect smtp timeout 3600
ip inspect name autosec_inspect tftp timeout 30
ip inspect name autosec_inspect udp timeout 15
ip inspect name autosec_inspect tcp timeout 3600
ip inspect name ANTI-ATTACK icmp audit-trail on
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
ip ips sdf location flash:attack-drop.sdf
ip ips fail closed
ip ips deny-action ips-interface
ip ips name ANTI-ATTACK
login block-for 3600 attempts 3 within 120
!
!
crypto pki trustpoint TP-self-signed-
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate
revocation-check none
rsakeypair TP-self-signed
!
!
crypto pki certificate chain TP-self-signed
quit
username privilege 15 user-maxlinks 2
archive
log config
logging enable
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
!
interface Ethernet0
ip address 10.10.10.1 255.255.255.252
ip access-group IDS_Eth0_Out out
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
no cdp enable
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
atm vc-per-vp 64
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/32
pppoe-client dial-pool-number 1
!
!
interface FastEthernet1
duplex auto
speed auto
!
interface FastEthernet2
duplex auto
speed auto
!
interface FastEthernet3
duplex auto
speed auto
!
interface FastEthernet4
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip access-group 139 in <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
ip verify unicast source reachable-via rx allow-default 100
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat outside
ip inspect autosec_inspect out
ip ips ANTI-ATTACK in
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
dialer remote-name redback
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname
ppp chap password
ppp pap sent-username password
ppp ipcp dns request
ppp ipcp wins request
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
!
no ip http server
ip http secure-server
!
ip nat inside source list 102 interface Dialer1 overload
!
!
ip access-list extended IDS_Eth0_Out
permit ip host 192.168.1.10 any
permit ip any any
logging trap notifications
logging facility syslog
logging 192.168.1.3
access-list 11 permit 10.10.10.2
access-list 102 permit ip 10.10.10.0 0.0.0.3 any
access-list 111 permit icmp any any redirect
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit udp any any eq tftp
access-list 111 deny ip 127.0.0.0 0.255.255.255 any
access-list 111 deny ip 192.0.0.0 0.255.255.255 any
access-list 111 deny ip 172.0.0.0 0.255.255.255 any
access-list 111 deny ip 10.0.0.0 0.255.255.255 any
access-list 111 deny ip host 0.0.0.0 any
access-list 111 deny ip 224.0.0.0 31.255.255.255 any
access-list 111 deny icmp any any redirect
access-list 111 deny icmp any any echo
access-list 111 deny icmp any any echo-reply
access-list 111 permit ip any any
access-list 139 deny ip 127.0.0.0 0.255.255.255 any
access-list 139 deny ip 192.0.0.0 0.255.255.255 any
access-list 139 deny ip 172.0.0.0 0.255.255.255 any
access-list 139 permit tcp any any eq ftp <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
access-list 139 permit tcp any any eq ftp-data<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
dialer-list 1 protocol ip permit
!
!
!
control-plane
!
!
line con 0
no modem enable
transport output all
line aux 0
transport output none
line vty 0 4
access-class 11 in
transport input ssh
transport output ssh
!
scheduler max-task-time 5000
end
C837#
ASA5505#
I dunno what's happening why from an Internet connection with an internal FTP server on LAN 192.168.1.1 this is not accessible
I'll have a look later
While, if someone is able to see where's my fault please tell me
Thanks in advance !!
