ASA help needed

cdickerson — Mon, 11 Mar 2019 19:29:20 GMT

Not even sure what I am trying to do is called. But here is what I got. I have a ASA 5520 running 8.3. I have sub interfaces on my inside interface. They have different security levels and I have the ASA configured to not allow same security level interfaces to communicate. One of the subinterfaces has a Exchange OWA server; it has a static NAT going to a public IP on my outside interface (this internal subinterface has a higher security level). My other subinterface has a bunch of workstations trying to access the OWA server. They have a PAT NAT configured to send the entire network to another IP address on the outside interface. What I am trying to do is have them access the OWA server via it's outside address. Doesn't seem to work. So I guess I am asking how do I allow two outside IP's communicate/route to each other? Thanks

-Craig

Re: ASA help needed

mirober2 — Fri, 31 Dec 2010 18:32:58 GMT

Hi Craig,

All you'll need is the following config, though make sure it doesn't overlap with anything you already have configured:

Assumptions:
OWA internal IP = 192.168.1.100
OWA external IP = A.B.C.D
Interface name that protects OWA = inside
"Other subinterface" name = inside2
Outside/Internet interface name = outside
object network OWA
    host 192.168.1.100
    nat (inside,any) static A.B.C.D
access-list outside_access_in permit tcp any host 192.168.1.100 eq https
access-list inside2_access_in permit tcp any host 192.168.1.100 eq https
access-group outside_access_in in interface outside
access-group inside2_access_in in interface inside2

The above config will allow hosts on inside2 and outside to access the OWA server by its public IP address, A.B.C.D. Give that a try and if you're still running into issues, please post sanitized copies of 'show run object', 'show run nat', and 'packet in inside2 tcp 12345 A.B.C.D 443'.

Hope that helps.

-Mike

topic ASA help needed in Network Security

ASA help needed

Re: ASA help needed