Inbound NAT question

roger perkin — Tue, 12 Mar 2019 00:33:13 GMT

I have a network with 2 ASA's with different blocks of IP's on each.

I have configured an inbound NAT to a web server on ASA2

The inbound NAT works fine, and when I hit the external address I get a hit on the access list and I see the connection made inbound

%ASA-6-302013: Built inbound TCP connection 11189017 for ASA_Public_IP:*.*.*.*/50038 (*.*.*.*/50038) to Web-Server:192.168.2.19/80 (*.*.*.*/80)

However that is it, it times out and dies

My question is do I have to allow that server back out? I am running 8.4(2)

Or is the server taking the default route of the network back out which is out of ASA1?

I couldnt' see anything in the logs on ASA1 to suggest this.

If anyone could advise on the routing behaviour of this setup, will the server just try to route back out to the remote address via the default and if so can I make the server go back out of ASA2?

I was looking into policy routing to change the default for that server to be ASA2

Thanks

Roger

Inbound NAT question

Julio Carvajal — Thu, 06 Dec 2012 00:39:25 GMT

My question is do I have to allow that server back out? I am running 8.4(2)

No, you do not need that,

Or is the server taking the default route of the network back out which is out of ASA1?

Should not be the case but just to make sure lets do a capture

This on the inside interface of ASA2

cap capin interface inside match tcp host inside_server host Outside_client

Regards,

Julio

topic Inbound NAT question in Network Security

Inbound NAT question

Inbound NAT question