topic Re: Why is Source IP iOutside interface IP of ASA5505 in Network Security

Why is Source IP iOutside interface IP of ASA5505

CiscoBrownBelt — Wed, 20 Mar 2019 00:54:56 GMT

So I am looking at logs on my ASA5505 in my lab and noticed when doing pings from a host on the Outside interface, the source IP in Real-time log viewer is the Outside interface and not host machine - see attached.

Also, I don't see pings on the logs when they are successful only when the are denied is this normal?

Re: Why is Source IP iOutside interface IP of ASA5505

Rob Ingram — Wed, 20 Mar 2019 01:07:41 GMT

Hi,
Do you have nat configured?
If you run "debug icmp trace" on the ASA you will be able to see the output of the ping and also the nat translation taking place.

HTH

Re: Why is Source IP iOutside interface IP of ASA5505

CiscoBrownBelt — Wed, 20 Mar 2019 02:36:27 GMT

No that is the weird thing.

ASA# sh nat
ASA#

Also, I am trying to allow internal hosts to the net. It works if I just allow all IP suite, but when just doing http, https, and DNS it doesn't work, logs keep saying the Outside interface denies it on port 53.

Re: Why is Source IP iOutside interface IP of ASA5505

Dennis Mink — Wed, 20 Mar 2019 08:05:37 GMT

Bluebelt. So you have an access list into your internal interface permitting any from your internal lan. But when you make it morr granular and permit only http it stops working? Can you share config after sanatising. Cheers