Hi all,
We have a problem with a customer's ASA5510, running 8.4(2).
We are trying to configure the device to publish an internal server to the outside, on ports HTTP,HTTPS and SMTP. Also, I've been trying to publish an internal router's SSH service to the outside (for testing purposes). The issue seems to be two phased, so I'll try to split them...
1) No matter what ACL we write, we always end up getting to the implicit deny rule, making the connection drop.
We have configured nat on the device, to publish services on the outside. We have tried both manual and auto-nat strategy, and it all seems to get stuck at the ACL (regarding the system log). In the attached current configuration, I've done configuration for the internal server (SERVER-TMG, 192.168.101.13) to publish it's HTTP and SMTP services on the outside interface, via manual nat.
object network SERVER-TMG
host 192.168.101.13
description SERVER-TMG
!
object service HTTP
service tcp destination eq www
description HTTP
!
object service SMTP
service tcp destination eq smtp
description SMTP
!
nat (outside,inside_1) source static any any destination static interface SERVER-TMG service SMTP SMTP unidirectional
nat (outside,inside_1) source static any any destination static interface SERVER-TMG service HTTP HTTP unidirectional
Also, for testing, I've done auto-nat configuration for the internal router's SSH service, as below...
object network ROUTER-R1
host 192.168.220.253
!
object network ROUTER-R1
nat (inside_1,outside) static interface service tcp ssh ssh
!
The outside interface ACL is also configured:
access-list outside_access_in extended permit tcp any object ROUTER-R1 eq ssh
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit ip object RemoteVpnNet any log disable
access-list outside_access_in extended permit object HTTPS any any
access-list outside_access_in extended permit object HTTP any any
access-list outside_access_in extended permit object SMTP any any
access-list outside_access_in extended permit tcp any any eq ftp
access-list outside_access_in extended permit tcp any any eq ftp-data
access-group outside_access_in in interface outside
(I've even put in permit ip any any in there, just to make sure I'm not missing anything)
But even with this configuration, a packet-trace shows packets are dropped at the ACL (the implicit deny rule)...
ciscoasa# packet-tracer input outside tcp 5.5.5.5 41234 <OUTSIDE_INTERFACE_IP> ssh
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in <OUTSIDE_INTERFACE_IP> 255.255.255.255 identity
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Can anyone introduce any sense into this??? Are we missing anything?
2) This ASA had webvpn configured on the outside interface... I've yet disabled it (webvpn -> no enable outside) and even enabled it again on another port, but whatever I do, connections to the outside interface of the ASA redirects to "https://<OUTSIDE_INTERFACE_IP>/+CSCOE+/logon.html" as if webvpn is still running there...
This, also means that I cannot do NAT/PAT for the <outside_interface_ip>:443 to the internal server...
ciscoasa(config)# nat (outside,inside_1) source static any any destination static interface SERVER-TMG service HTTPS HTTPS unidirectional
ERROR: NAT unable to reserve ports.
Any ideas on this?
